CVE-2021-23175: 
NVIDIA GeForce Experience vulnerability analysis and mitigation

A vulnerability (CVE-2021-23175) was discovered in NVIDIA GeForce Experience's GameStream component, specifically in its user authorization mechanism. The vulnerability was disclosed on December 21, 2021, affecting all versions of GeForce Experience prior to 3.24.0.126 on Windows systems. The issue stems from GameStream's incorrect application of individual user access controls for users on the same device (NVIDIA Bulletin).

The vulnerability received a CVSS v3.1 base score of 8.2 (High), with a vector string of AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. This indicates that the vulnerability requires local access, low attack complexity, low privileges, and user interaction to exploit. The scope is changed, and the impact on confidentiality, integrity, and availability is high (NVIDIA Bulletin).

The vulnerability can lead to multiple severe security impacts including escalation of privileges, information disclosure, data tampering, and denial of service. These impacts affect resources beyond the intended security authority of GameStream, potentially compromising the security of the entire system (CVE Mitre).

NVIDIA released a security update to address this vulnerability. Users are advised to update to GeForce Experience version 3.24.0.126 or later. The update can be obtained through the GeForce Experience Downloads page, or users can open the client to automatically apply the security update (NVIDIA Bulletin).

The vulnerability was responsibly disclosed by security researcher David Köhler, who was acknowledged by NVIDIA in their security bulletin (NVIDIA Bulletin).