NVIDIA has fixed a vulnerability in Windows NVIDIA GeForce Experience (GFE) software that could allow attackers to execute code, conduct denial of service (DoS) attacks , or gain elevated privileges on unpatched systems.
The vulnerability has been designated CVE-2020-5964 and requires local access to the affected device. Attackers would not be able to exploit this vulnerability remotely. However, it could be exploited using malicious tools distributed on systems with vulnerable NVIDIA GFE versions.
NVIDIA GeForce Experience (GFE) is software for GeForce GTX, RTX, TITAN X and other NVIDIA GeForce graphics cardsand can be installed on computers running Windows 7 or later.
“It updates your drivers, automatically optimizes your game settings, and provides an easy way to share your best gaming moments with friends,” says NVIDIA.
The vulnerability is rated moderate in severity. After successfully exploiting it, attackers could execute code on Windows running outdated versions of NVIDIA GFE software.
They can also gain access to sensitive information or render it useless by carrying out a denial of service attack.
The GeForce Experience vulnerability CVE‑2020‑5964, fixed in the security July 2020 is detailed in the table below.
| CVE ID | Description | Base Score | Vector |
| CVE‑2020‑5964 | NVIDIA GeForce Experience software contains a vulnerability in the service host component, in which the integrity check of application resources may be missed. Such an attack may lead to code execution, denial of service, or information disclosure. | 6.5 | AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H |
NVIDIA says that users with vulnerable versions of NVIDIA GeForce Experience (GFE) software should consult a security professional to assess the risk to their systems.
Which versions of NVIDIA GeForce Experience are vulnerable?
The security issue affects Windows computers running versions of NVIDIA GeForce Experience (GFE) prior to 3.20.4.
“Previous software branch releases that support this product are also affected,” NVIDIA explained. Therefore, you should update to the new version immediately.
To update their systems, NVIDIA GeForce Experience (GFE) users can go to the GeForce Experience Downloads or launch the GFE client on Windows computers to receive the update using the built-in automatic update mechanism.
