CVE-2024-0089: High NVIDIA GPU Driver Information Disclosure

CVE-2024-0089 is a High severity (CVSS 7.8) flaw in the NVIDIA GPU Display Driver for Windows, where information from a previous client or another process could be disclosed. NVIDIA fixed it in drivers 555.99, 552.55, 538.67 and 475.06, depending on branch. Install the fixed driver for your branch.

What's affected

• Product: NVIDIA GPU Display Driver for Windows, including the vGPU guest driver for Windows and the Cloud Gaming Windows guest driver.
• Fixed Windows display driver versions: R555 555.99, R550 552.55, R535 538.67, R470 475.06.
• Fixed vGPU Windows guest drivers: 17.2 (552.55), 16.6 (538.67) and 13.11 (475.06). Cloud Gaming Windows guest: 555.99.
• Severity: High, CVSS 7.8, local vector, low privileges. NVIDIA lists code execution, information disclosure and data tampering as possible impacts. The record and the bulletin agree.
• NVIDIA says its tables may not be exhaustive. If your branch has no listed fix, move to the latest branch release.
• Exploitation: the record's KEV flag is false, and the bulletin does not report exploitation.

How to check if you're exposed

On a Windows machine with an NVIDIA GPU, run in a terminal:

nvidia-smi

and read the driver version, or open NVIDIA Control Panel and check System Information. Match it to your branch and compare it with the fixed numbers above. Branches differ, so 538.x and 552.x are separate tracks and must each reach their own fixed build.

For fleets, pull the driver version from your endpoint management tool, then group machines by branch.

What to do now

1. Collect driver versions from Windows workstations, render nodes and VDI guests.
2. Group them by branch (R555, R550, R535, R470).
3. Roll out the fixed driver for each branch from the NVIDIA Driver Downloads page.
4. Update vGPU guest drivers through the NVIDIA Licensing Portal, and keep them matched to the host release.
5. Verify versions after rollout.

Why it matters

The record maps this to CWE-665 (CWE-665), improper initialization. Memory or resources are handed to a new user without being cleared, so leftover data from an earlier client can still be there. On a GPU, that can mean data from another process.

Shared GPUs make it more serious. In a virtual desktop pool or a render farm, a previous user may be a different person or tenant. The score is high because NVIDIA lists code execution among possible outcomes, but the vector is local, so an attacker needs a foothold first.

Keep in mind that a driver update is a different job from an application update. It usually needs a reboot, it can affect software that depends on specific driver behavior, and on virtual desktop pools it needs matching host and guest releases. Test the fixed build on one representative machine per branch first, then roll it out in waves. Record the version you reach, so the next bulletin starts from a known baseline.

Quick check

Sources

• NVIDIA security bulletin 5551 (vGPU and GPU display driver, June 2024)
• Safeguard Gold entry for CVE-2024-0089

Last reviewed: 19 October 2026.