Improper access control in NVIDIA App (formerly GeForce Experience) - CVE-2021-23175
Published: December 22, 2021
Vulnerability identifier: #VU59082
CSH Severity: Low
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-23175
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privilege son the system.
The vulnerability exists due to improper access restrictions where GameStream does not correctly apply individual user access controls for users on the same device. A local user can run a specially crafted program to escalate privileges on the system.
Affected software
NVIDIA App (formerly GeForce Experience)
How to mitigate CVE-2021-23175
Install updates from vendor's website.
NVIDIA App (formerly GeForce Experience) - update to 3.24.0.126