What’s Vulnerable › Vulnerabilities

CVE-2015-7865

• Severity: high (CVSS 7.7 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2015-11-24 · updated 2026-06-17
• Weakness: CWE-284

Description

nvSCPAPISvr.exe in the Stereoscopic 3D Driver Service in the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 before 358.87 on Windows does not properly restrict access to the stereosvrpipe named pipe, which allows local users to gain privileges via a commandline in a number 2 command, which is stored in the HKEY_LOCAL_MACHINE explorer Run registry key, a different vulnerability than CVE-2011-4784.

Affected products

• Nvidia Corporation GPU Display Driver: from 340 before 341.92; from 352 before 354.35; from 358 before 358.87 — fixed in 341.92, 354.35, 358.87

How to fix

Upgrade to a fixed version: Nvidia Corporation GPU Display Driver 341.92, 354.35, 358.87. Check the vendor advisory for mitigations.

References

• http://nvidia.custhelp.com/app/answers/detail/a_id/3807/kw/security
• http://packetstormsecurity.com/files/134520/NVIDIA-Stereoscopic-3D-Driver-Service-Arbitrary-Run-Key-Creation.html
• http://www.securitytracker.com/id/1034173
• https://code.google.com/p/google-security-research/issues/detail?id=515
• https://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04971867
• https://www.exploit-db.com/exploits/38792/
• http://nvidia.custhelp.com/app/answers/detail/a_id/3807/kw/security
• http://packetstormsecurity.com/files/134520/NVIDIA-Stereoscopic-3D-Driver-Service-Arbitrary-Run-Key-Creation.html
• http://www.securitytracker.com/id/1034173
• https://code.google.com/p/google-security-research/issues/detail?id=515
• https://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04971867
• https://www.exploit-db.com/exploits/38792/

Get alerted when CVE-2015-7865 or the next vulnerability affects your stack