CVE-2019-5688

MEDIUM

NVIDIA NVFlash/NVUFlash <5.588.0 & GPUModeSwitch <2019-11 Privilege Escalation via Device Memory Access

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-5688. PoCs published by watsa01.

AI-analyzed exploit summary This PoC demonstrates arbitrary read/write access to physical memory via a vulnerable NVFLASH driver (CVE-2019-5688). It maps physical memory to user-space and performs test operations, confirming kernel-level memory manipulation.

Description

NVIDIA NVFlash, NVUFlash Tool prior to v5.588.0 and GPUModeSwitch Tool prior to 2019-11, NVIDIA kernel mode driver (nvflash.sys, nvflsh32.sys, and nvflsh64.sys) contains a vulnerability in which authenticated users with administrative privileges can gain access to device memory and registers of other devices not managed by NVIDIA, which may lead to escalation of privileges, information disclosure, or denial of service.

Exploits (1)

nomisec WORKING POC 2 stars
by watsa01 · poc
https://github.com/watsa01/CVE-2019-5688

This PoC demonstrates arbitrary read/write access to physical memory via a vulnerable NVFLASH driver (CVE-2019-5688). It maps physical memory to user-space and performs test operations, confirming kernel-level memory manipulation.

Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: NVIDIA NVFLASH driver (versions prior to fix)
No auth needed
Prerequisites: Local access to a vulnerable system · NVFLASH driver installed
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

CVSS v3 6.7
EPSS 0.0037
EPSS Percentile 28.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

Status published
Products (3)
nvidia/gpumodeswitch < 2019-11
nvidia/nvflash < 5.588.0
nvidia/nvuflash < 5.588.0
Published Nov 18, 2019
Tracked Since Feb 18, 2026