CVE-2024-0146

High

Published: 28 January 2025

Published

28 January 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0004 11.2th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-0146 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Custhelp (inferred from references). Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Escape to Host (T1611); ranked at the 11.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

CVE-2024-0146 is a vulnerability in NVIDIA vGPU software, specifically within the Virtual GPU Manager component. It enables a malicious guest to cause memory corruption, corresponding to CWE-120 (Buffer Copy without Checking Size of Input). The vulnerability received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-01-28.

A malicious guest with local access and low privileges (PR:L) can exploit this issue with low attack complexity and no user interaction required. Successful exploitation could lead to code execution, denial of service, information disclosure, or data tampering.

The NVIDIA security advisory at https://nvidia.custhelp.com/app/answers/detail/a_id/5614 provides details on mitigation and available patches.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2024-15945

Vulnerability details

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause memory corruption. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, or data tampering.

CWE(s): CWE-120

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1611 Escape to Host Privilege Escalation

Adversaries may break out of a container or virtualized environment to gain access to the underlying host.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Memory corruption in vGPU Manager directly enables guest-to-host escape (T1611) and host privilege escalation (T1068) via local exploitation from a malicious guest VM.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1