Skip to content
Noroxi
CVE-2015-7869· NVD / CVE Program· CNA mitre

Multiple integer overflows in the kernel mode driver for the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 bef

Multiple integer overflows in the kernel mode driver for the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 before 358.87 on Windows and R304 before 304.131, R340 before 340.96, R352 before 352.63, and R358 before 358.16 on Linux allow local users to obtain sensitive information, cause a denial of service (crash), or possibly gain privileges via unknown vectors, which trigger uninitialized or out of bounds memory access. NOTE: this identifier has been SPLIT per ADT2 and ADT3 due to different vulnerability type and affected versions. See CVE-2015-8328 for the vulnerability in the NVAPI support layer in NVIDIA drivers for Windows.

MediumCVSS 6.6 · v2.0—No exploit Fix available
Published
Nov 24, 2015
Updated
Jun 16, 2026
EPSS
0.4% · 31th percentile
Follow this CVE

Sign in to follow · You’ll be notified if a followed record enters KEV, gets an exploit or is updated.

Report tools

JSON

Action score

26

Monitor

Low priority for now.

CVSS
26 / 40 · 6.6 / 10
CISA KEV
0 / 30 · Not listed
EPSS
0 / 30 · 0.4%

Affected systems

VendorProduct
nvidiagpu driver
canonicalubuntu linux
linuxlinux kernel
microsoftwindows

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

  • canonical ubuntu linux12.04
  • canonical ubuntu linux14.04
  • canonical ubuntu linux15.04
  • canonical ubuntu linux15.10
  • nvidia gpu driver358 and later · before 358.16
  • nvidia gpu driver340 and later · before 341.96
  • nvidia gpu driver352 and later · before 354.35
  • nvidia gpu driver358 and later · before 358.87
  • nvidia gpu driver304 and later · before 304.131
  • nvidia gpu driver340 and later · before 340.96
  • nvidia gpu driver352 and later · before 352.63
  • nvidia gpu driver346.22

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

EcosystemPackageAffected rangeFix
Debian:12nvidia-graphics-driversbefore 352.63-1352.63-1

Same product

nvidia: all records

Other highest-scoring records for the same primary product.

  • CVE-2019-5684NVIDIA Windows GPU Display Driver (all versions) contains a vulnerability in DirectX drivers, in which a specially crafted shader can cause
    42Plan
  • CVE-2019-5685NVIDIA Windows GPU Display Driver (all versions) contains a vulnerability in DirectX drivers, in which a specially crafted shader can cause
    41Plan
  • CVE-2015-5053The host memory mapping path feature in the NVIDIA GPU graphics driver R346 before 346.87 and R352 before 352.41 for Linux and R352 before 3
    41Plan
  • CVE-2013-5986Unspecified vulnerability in NVIDIA graphics driver Release 331, 325, 319, 310, and 304 has unknown impact and attack vectors, a different v
    41Plan
  • CVE-2018-6250NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a NULL po
    35Monitor
  • CVE-2018-6249NVIDIA GPU Display Driver contains a vulnerability in kernel mode layer handler where a NULL pointer dereference may lead to denial of servi
    35Monitor

Remediation

Which version to upgrade to

Fix versions compiled from the vendor, package registries and Microsoft. Verify the vendor's note before upgrading.

Product / packageFixed versionSource
debian:nvidia-graphics-drivers352.63-1 · Debian:12Package registry (OSV)

Exploit status

No known public exploit

No public exploit has been observed yet. That doesn't mean you're safe, only that the bar is a little higher.

Research context

For pentesters and researchers: attack profile, score disagreement, timeline, patch commits, credits, variant and chain candidates, bug bounty scope. All derived from existing data; no exploit code.

Timeline

From publication to today: proof of concept, Metasploit module, CISA KEV and fix record. Dates are as reported by the sources.

No dated events beyond publication.

EPSS, last 120 days

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Patch and commit links

Commit, PR and diff links among the references. A starting point for patch-diffing and variant hunting; fixes, not exploits.

No commit or PR link among the references.

Credits

All researchers

Finders, reporters and analysts named in the CNA record. Click a name for that researcher’s other records.

No credits in the CNA record.

Variant candidates

Same product, same weakness class, within 18 months. If the patch missed the root cause, the sibling bug is here.

No nightly-computed relations.

Chain candidates

An authentication bypass and a privilege-requiring bug in the same product, published close together: combined they may become an unauthenticated path.

—

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

Technical details

Attack conditions

    If successful

    Confidentiality
    C · data can be read
    Integrity
    P · data or configuration can be modified
    Availability
    C · the service can be disrupted
    Attack complexity
    M
    Confidentiality impact
    C
    Integrity impact
    P
    Availability impact
    C

    Weakness class (CWE)

    CWE-189 · Numeric Errors

    CVSS vector

    AV:L/AC:M/Au:N/C:C/I:P/A:C

    nvd-primary

    Attack context

    MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

    MITRE has no CAPEC/ATT&CK mapping for this CWE.

    Noroxi analysis

    No Noroxi analysis for this record yet

    We don't hand-write analysis for all 385,000+ vulnerabilities; that wouldn't be honest. For notable, high-impact vulnerabilities our team writes the mechanism, detection and remediation steps.

    We use this product, ask for help

    Change log

    1. Fix✗ → ✓

    For records you follow, these changes also arrive as notifications. →

    References

    Vendor advisories and official records. Exploit/PoC links are deliberately left out.

    All records