CVE-2020-5978: 
NVIDIA GeForce Experience vulnerability analysis and mitigation

NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in its services where a folder is created by nvcontainer.exe under normal user login with LOCAL_SYSTEM privileges. This vulnerability was disclosed in October 2020 and affects Windows systems running NVIDIA GeForce Experience software (NVIDIA Bulletin, NVD).

The vulnerability is tracked as CVE-2020-5978 and has been assigned a CVSS v3.1 base score of 7.8 HIGH (vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue stems from the nvcontainer.exe process creating folders with LOCAL_SYSTEM privileges during normal user login operations, indicating a privilege management flaw (NVD).

The vulnerability could potentially lead to denial of service conditions or privilege escalation on affected systems. When exploited, an attacker could leverage the improper folder creation with elevated privileges to gain unauthorized access to system resources (NVIDIA Bulletin).

The vulnerability requires local access and low privileges to exploit. While specific exploit details are not publicly disclosed, the vulnerability's high CVSS score indicates significant potential impact if successfully exploited (NVD).

NVIDIA has released version 3.20.5.70 of GeForce Experience to address this vulnerability. Users are advised to update to this version or later either by downloading from the GeForce Experience Downloads page or by allowing the client to automatically apply the security update (NVIDIA Bulletin).

The vulnerability was discovered and reported by Hashim Jawad of ACTIVELabs, who received acknowledgment from NVIDIA for their responsible disclosure (NVIDIA Bulletin).