CVE-2024-0107 is a high severity (CVSS 7.8) out of bounds read in the user mode layer of the NVIDIA GPU Display Driver for Windows. An unprivileged user can trigger it. NVIDIA fixed it in drivers 556.12, 552.74, 538.78 and 475.14, depending on the branch.
What's affected
NVIDIA bulletin 5557 lists these fixes for Windows:
- GeForce, R555 branch: prior to 556.12 is affected, fixed in 556.12
- GeForce, R470 branch: prior to 475.14 is affected, fixed in 475.14
- RTX, Quadro, NVS and Tesla, R550: prior to 552.74, fixed in 552.74
- RTX, Quadro, NVS and Tesla, R535: prior to 538.78, fixed in 538.78
- RTX, Quadro, NVS and Tesla, R470: prior to 475.14, fixed in 475.14
NVIDIA says the list may not be complete, and that earlier branches may also be affected. If your branch is not listed, move to the latest release of a supported branch.
A Cisco Talos report (TALOS-2024-1956) is also in the record references. It names the NVIDIA GPU Compiler Driver component, in the shader functionality, and driver version 551.61 as affected, and gives a score of 7.8 as well. It does not name the fixed version.
How to check if you're exposed
Read the driver version on each Windows machine.
nvidia-smi --query-gpu=driver_version --format=csv,noheader
Compare it with the table. NVIDIA also notes that OEM drivers with the listed numbers include the fix, so a laptop vendor package may carry it under a different package name.
What to do now
- Find Windows machines with NVIDIA GPUs, including workstations and render hosts.
- Update to the fixed driver for the branch in use.
- For OEM managed machines, use the vendor driver package that matches the fixed driver number.
- Verify the version afterward and record it.
Why it matters
The weakness is CWE-125, out of bounds read. The driver reads memory past the end of a buffer. NVIDIA lists code execution, denial of service, escalation of privileges, information disclosure and data tampering as possible outcomes.
The vector is local with no privileges required but user interaction needed, so an attacker has to get a user to open or process something. The record does not mark it as exploited in the wild. Graphics drivers parse shader and content data from many sources, which is why they are a steady source of bugs. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan, and the Gold directory lists the CVE and CWE pages used here.
Quick check
Do the two sources agree?
On the score, yes: both give 7.8 High. The Talos page does not name a fixed version, so use the NVIDIA bulletin for that.
Does it need user interaction?
The NVIDIA vector has user interaction required, so an attacker must get a user to take some action.
Sources
Last reviewed: 19 October 2026.
