CVE-2022-34669 + CVE-2022-34671: High-Severity Windows GPU Driver Vulnerabilities That Set the Template
| CVE | Score | Type | Platform | Disclosed |
|---|---|---|---|---|
| CVE-2022-34669 | 8.8 High | User mode flaw — local exploit | Windows | November 2022 |
| CVE-2022-34671 | 8.5 High | Out-of-bounds write — remote exploit | Windows | November 2022 |
For executives
In November 2022, NVIDIA released a security update for its GPU display driver for Windows containing two high-severity vulnerabilities. CVE-2022-34669 allows an unprivileged local user to access or modify files that are critical to the GPU driver application, leading to code execution and privilege escalation. CVE-2022-34671 can be exploited remotely — an out-of-bounds write in the user mode driver layer enabling code execution without requiring physical access to the machine.
These are pre-2024 vulnerabilities, included because they represent the earliest documented high-severity attack surface in NVIDIA's GPU driver layer and establish the vulnerability class pattern that continued through the 2024 and 2025 disclosure cycles.
CVE-2022-34669: local user mode exploitation (CVSS 8.8)
An unprivileged local user — a standard Windows account with no administrative rights — can exploit this vulnerability to access or modify files that the GPU driver application treats as critical. Successful exploit leads to code execution, privilege escalation, information disclosure, data tampering, and denial of service.
CVE-2022-34671: remote out-of-bounds write (CVSS 8.5)
An unprivileged remote user can cause the driver to write data beyond the boundaries of a buffer. The remote attack vector (AV:N) means the attacker does not need local machine access. A network-accessible application that uses the NVIDIA GPU driver in its request handling can be the attack entry point.
The broader November 2022 bulletin
The November 2022 bulletin that contained these two CVEs addressed 29 vulnerabilities in total. CVE-2022-34669 and CVE-2022-34671 were identified by CERT-EU as critical in a December 2022 security advisory.