CVE-2026-24190: CWE-862 Missing Authorization in NVIDIA GeForce
LokiBot, an infostealer first advertised in May 2015, continues to operate after more than a decade with numerous variants. The malware targets credentials from over a hundred software products including browsers, cryptocurrency wallets, password managers, email and FTP clients. A recent campaign delivers LokiBot through malspam with JScript email attachments, executing a multi-stage infection chain involving PowerShell loaders and .NET injectors protected by ConfuserEx. The final payload uses process injection into aspnet_compiler.exe, employing API hashing techniques to evade detection. While LokiBot maintains extensive credential theft capabilities, recent samples exhibit broken persistence mechanisms due to patched decryption subroutines. The malware communicates with C2 servers to exfiltrate compressed stolen data and await further commands, demonstrating continued evolution despite reduced activity in recent years.
AI Analysis
Technical Summary
CVE-2026-24190 is a vulnerability classified as CWE-862 (Missing Authorization) affecting the NVIDIA GeForce display driver on Windows and Linux platforms. The issue arises from missing authorization checks in the kernel mode layer, which permits users with limited privileges to access GPU resources improperly. This can lead to multiple impacts including denial of service, privilege escalation, information disclosure, data tampering, and code execution. The vulnerability affects all driver versions prior to 595.71.05. As of the current information, there is no official vendor advisory or patch available, and no known exploitation in the wild has been reported.
Potential Impact
The vulnerability allows unauthorized access to GPU resources by users with limited privileges, potentially enabling denial of service, privilege escalation, information disclosure, data tampering, and arbitrary code execution. This could compromise system integrity and confidentiality if exploited.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or advisory is available, users should monitor NVIDIA communications for updates and avoid running untrusted code with limited privileges that might exploit this vulnerability.
Indicators of Compromise
- domain: alphastand.trade
- domain: alphastand.win
- domain: alphastand.top
- url: http://alphastand.top/alien/fre.php
- url: http://alphastand.trade/alien/fre.php
- url: http://alphastand.win/alien/fre.php
- url: http://kbfvzoboss.bid/alien/fre.php
- hash: c099f965144bccd0b590f946659fc3c0747c54aef505b6caaca9078712f455fb
- url: http://158.94.211.95/kelly/five/fre.php
- cve: CVE-2026-24190
- hash: 64c7dd0a3a3ae49977ac05913d3878000cce14e5d8c1ee05b782bdfd648bde91
- hash: ad10ff9043d6f327045943635fcbd0c5918acb79dc998db92ee4c7dee5224710
- hash: 4c9f271242f61f1a31b8146305e9a7ed512c521445d4f7a7a901e301307add3d
- hash: 5864a697bd7b339f56b05405f29a097cd027cafdcc4e63c2aaeccccbf930605f
- hash: a484efb02ab3c049666af91363bfdf77
- hash: c44ec9336ed67352ee021097876a82407c40eea1
CVE-2026-24190: CWE-862 Missing Authorization in NVIDIA GeForce
Description
LokiBot, an infostealer first advertised in May 2015, continues to operate after more than a decade with numerous variants. The malware targets credentials from over a hundred software products including browsers, cryptocurrency wallets, password managers, email and FTP clients. A recent campaign delivers LokiBot through malspam with JScript email attachments, executing a multi-stage infection chain involving PowerShell loaders and .NET injectors protected by ConfuserEx. The final payload uses process injection into aspnet_compiler.exe, employing API hashing techniques to evade detection. While LokiBot maintains extensive credential theft capabilities, recent samples exhibit broken persistence mechanisms due to patched decryption subroutines. The malware communicates with C2 servers to exfiltrate compressed stolen data and await further commands, demonstrating continued evolution despite reduced activity in recent years.
CVSS v3.1
Score 7.8high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-24190 is a vulnerability classified as CWE-862 (Missing Authorization) affecting the NVIDIA GeForce display driver on Windows and Linux platforms. The issue arises from missing authorization checks in the kernel mode layer, which permits users with limited privileges to access GPU resources improperly. This can lead to multiple impacts including denial of service, privilege escalation, information disclosure, data tampering, and code execution. The vulnerability affects all driver versions prior to 595.71.05. As of the current information, there is no official vendor advisory or patch available, and no known exploitation in the wild has been reported.
Potential Impact
The vulnerability allows unauthorized access to GPU resources by users with limited privileges, potentially enabling denial of service, privilege escalation, information disclosure, data tampering, and arbitrary code execution. This could compromise system integrity and confidentiality if exploited.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or advisory is available, users should monitor NVIDIA communications for updates and avoid running untrusted code with limited privileges that might exploit this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- nvidia
- Date Reserved
- 2026-01-21T19:09:32.733Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Indicators of Compromise
Domain
| Value | Description | Copy |
|---|---|---|
domainalphastand.trade | — | |
domainalphastand.win | — | |
domainalphastand.top | — |
Url
| Value | Description | Copy |
|---|---|---|
urlhttp://alphastand.top/alien/fre.php | — | |
urlhttp://alphastand.trade/alien/fre.php | — | |
urlhttp://alphastand.win/alien/fre.php | — | |
urlhttp://kbfvzoboss.bid/alien/fre.php | — | |
urlhttp://158.94.211.95/kelly/five/fre.php | — |
Hash
| Value | Description | Copy |
|---|---|---|
hashc099f965144bccd0b590f946659fc3c0747c54aef505b6caaca9078712f455fb | — | |
hash64c7dd0a3a3ae49977ac05913d3878000cce14e5d8c1ee05b782bdfd648bde91 | — | |
hashad10ff9043d6f327045943635fcbd0c5918acb79dc998db92ee4c7dee5224710 | — | |
hash4c9f271242f61f1a31b8146305e9a7ed512c521445d4f7a7a901e301307add3d | — | |
hash5864a697bd7b339f56b05405f29a097cd027cafdcc4e63c2aaeccccbf930605f | — | |
hasha484efb02ab3c049666af91363bfdf77 | — | |
hashc44ec9336ed67352ee021097876a82407c40eea1 | — |
Cve
| Value | Description | Copy |
|---|---|---|
cveCVE-2026-24190 | — |
Threat ID: 6a15e035891d628fdc67d377
Added to database: 05/26/2026, 18:02:29 UTC
Last enriched: 07/25/2026, 20:52:28 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 108
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.