Nvidia patches three serious security flaws — what to do now

News
By published

Desktop-software flaw could lead to malware infection

Nvidia GeForce
(Image credit: Shutterstock)

It's been nearly a month since the last round of Nvidia security patches, and lo and behold, we've got more. 

The graphics-card maker issued a security bulletin Oct. 22 warning that versions of its GeForce Experience software prior to 3.20.5.70 had three security flaws, ranging from a very serious "uncontrolled search path" that could be used to load malicious software to a relatively minor privilege-escalation issue. 

None of these flaws can be remotely exploited over the internet, and the attacker must have access to the system. But that attacker could be malware that infects the machine in other ways, such as through email attachments or Trojanized plug-ins or extensions.

GeForce Experience is Nvidia's desktop interface for users of its GeForce graphics cards. The Experience lets you share livestreams and videos as well as manage drivers and supported games. 

Nvidia does have a lot of security patches, but that's not necessarily a bad thing as it means its developers are on the ball. Better to get a lot of patches than to get none at all.

How to update your graphics card

To update the GeForce Experience software, simply open the software and it should auto-update to version 3.20.5.70. (You can find the version number in Settings --> General). If that doesn't work, you can go to the GeForce Experience page on the Nvidia website to download the latest version of the software.

Paul Wagenseil
Paul Wagenseil

Paul Wagenseil is a senior editor at Tom's Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-haul driver, code monkey and video editor. He's been rooting around in the information-security space for more than 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown up in random TV news spots and even moderated a panel discussion at the CEDIA home-technology conference. You can follow his rants on Twitter at @snd_wagenseil.