CVE-2024-0096 is a high severity (CVSS 7.5) improper privilege management flaw in the NVIDIA ChatRTX user interface for Windows. A user can change execution flow through crafted input. NVIDIA lists all versions up to and including 0.2.1 as affected and 0.3 as the fixed release.
What's affected
NVIDIA bulletin 5533 covers NVIDIA ChatRTX for Windows. All versions up to and including 0.2.1 are affected, and the bulletin says earlier releases are also affected. The fixed version is ChatRTX 0.3.
The same bulletin covers CVE-2024-0097, a related privilege issue in the ChatRTX UI through interprocess communication. Updating to 0.3 addresses both.
How to check if you're exposed
ChatRTX is a desktop application, so there is no package manager to query on most machines. Open the app and check the version in its about or settings screen, or check the installed programs list in Windows Settings. If you manage Windows devices centrally, query installed software from your endpoint management tool and filter for ChatRTX.
Any version at or below 0.2.1 should be treated as vulnerable.
What to do now
- Find machines with ChatRTX installed. It is often installed by individual developers and researchers rather than through IT.
- Upgrade to ChatRTX 0.3 or later using NVIDIA's download.
- Until the upgrade is done, avoid running ChatRTX on shared or sensitive Windows hosts.
- Remove the application from machines that no longer need it.
Why it matters
The record classifies this as CWE-269, improper privilege management. The UI can be driven by user input in a way that alters execution flow and reaches actions the user should not have. NVIDIA lists information disclosure, escalation of privileges and data tampering as possible outcomes.
The CVSS vector is local with high attack complexity and a changed scope. That keeps the score at 7.5 rather than higher, but a local privilege problem on a workstation that holds private documents for a local language model is worth closing quickly. The record does not mark it as exploited in the wild. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan, and the Gold directory lists the CVE and CWE pages used here.
Quick check
Is CVE-2024-0097 a separate issue?
Yes. It is a different flaw in the same product, tracked separately, and the same ChatRTX 0.3 release fixes both.
Do I need network exposure for this?
The vector in the NVIDIA bulletin is local, so an attacker needs access to the machine.
Sources
Last reviewed: 19 October 2026.
