CVE-2023-4211
Exploited in the Wild
✓ Confirmed 0-Day
★ Google Project Zero
Triaged: March 5, 2026
3 articles
EPSS Score
Source: FIRST.org · 2026-05-24
0.2%
probability
This CVE has a 0.2% probability
of being exploited in the next 30 days.
0%
Top 42.1th percentile of all CVEs
100%
CVSS v3.1
Source: NVD5.5
MEDIUM
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Description
NVDA local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.
Affected Products
arm
5th gen gpu architecture kernel driver
arm
bifrost gpu kernel driver
arm
midgard gpu kernel driver
arm
valhall gpu kernel driver
Attack Intelligence
CWE-118
· Incorrect Access of Indexable Resource ('Range Error')
CWE-119
· Buffer Overflow
CWE-416
· Use After Free
CWE-664
· Improper Control of a Resource Through its Lifetime
CWE-666
· Operation on Resource in Wrong Phase of Lifetime
CWE-672
· Operation on a Resource after Expiration or Release
CWE-825
· Expired Pointer Dereference
Google Project Zero
Patched
Oct. 2, 2023
Reported by
Maddie Stone of Google's Threat Analysis Group and Jann Horn of Google Project Zero
Root Cause Analysis
https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2023/CVE-2023-4211.html
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4211
US Government Resource
Signal Intelligence
Confidence
95%
EPSS
0.2%
CVSS v3.1
5.5
Mentions
3
Last Seen
Oct 03, 2023
CNA Information
Analyst Note
Auto-imported from Google Project Zero — confirmed zero-day by definition.
Triage Info
Decided atMar 05, 2026