CVE-2022-42291highCWE-1386

CVE-2022-42291: high-severity vulnerability in NVIDIA GeForce Experience

Published · Updated

Follow this CVE+ Monitor NVIDIA GeForce Experience

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 0.2%
In short

NVIDIA GeForce Experience installer has a flaw that can accidentally delete data from linked folders during installation. This happens only if a user runs the installer from a compromised directory, putting their files at risk of being tampered with.

Technical detail

The vulnerability exists in the NVIDIA GeForce Experience installer's file handling logic, where improper path resolution during installation can lead to unintended deletion of data in linked locations. Exploitation requires user interaction (launching the installer from a compromised directory) and results in data tampering via unintended file deletion.

Summary generated and translated by AI from the official description.
NVIDIA GeForce Experience contains a vulnerability in the installer, where a user installing the NVIDIA GeForce Experience software may inadvertently delete data from a linked location, which may lead to data tampering. An attacker does not have explicit control over the exploitation of this vulnerability, which requires the user to explicitly launch the installer from the compromised directory.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H
Affected products
NVIDIA · GeForce Experience
Related CVEs — NVIDIA GeForce Experience

In the same product, most dangerous first.

CVE-2019-5702—CVE-2019-5702EPSS 0.4%CVE-2022-31611MEDIUMCVE-2022-31611EPSS 0.2%CVE-2022-42292MEDIUMCVE-2022-42292EPSS 0.2%