NVIDIA 'GreenSection' Memory Corruption PoC Released: Detection and Hardening Guidance for Windows GPU Driver Zero-Day

---
title: GreenSection NVIDIA PoC Execution Artifact
id: 3f7c2a91-8b4d-4e5a-9c16-2d7a1f0e8b55
status: experimental
description: Detects execution of files or processes referencing the GreenSection NVIDIA memory corruption proof-of-concept released by Chaotic Eclipse. Public PoC code is often renamed, but early-stage testing and red-team validation frequently retains original artifact naming.
references:
  - https://securityaffairs.com/198589/hacking/chaotic-eclipse-released-a-poc-for-nvidia-greensection-memory-corruption-zero-day.html
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|contains: 'greensection'
  selection_cmd:
    CommandLine|contains:
      - 'greensection'
      - 'nvidia_poc'
  condition: 1 of selection_*
falsepositives:
  - Authorized security research and red team validation
level: high
---
title: Application Crash In NVIDIA User-Mode Display Driver Module
id: 9d4e1b72-5a3c-4f68-b208-6e9d3c1a7452
status: experimental
description: Detects application error events where the faulting module is an NVIDIA user-mode display driver DLL. Memory corruption PoCs and exploit attempts against the NVIDIA user-mode driver reliably produce crashes in these modules. Baseline your environment first — correlate with process name and frequency.
references:
  - https://securityaffairs.com/198589/hacking/chaotic-eclipse-released-a-poc-for-nvidia-greensection-memory-corruption-zero-day.html
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  product: windows
  service: application
detection:
  selection_provider:
    Provider_Name: 'Application Error'
  selection_module:
    Message|contains:
      - 'nvwgf2umx.dll'
      - 'nvd3dumx.dll'
      - 'nvoglv64.dll'
      - 'nvoglv32.dll'
      - 'nvvkwddm.dll'
  condition: all of selection_*
falsepositives:
  - Legitimate driver instability after driver updates or on faulty hardware — investigate clusters, repeat crashes on a single host, and crashes tied to browsers or sandboxed renderers
level: medium
---
title: Browser Renderer Process Repeatedly Crashing In NVIDIA Driver Module
id: 6b1f8d34-2e7a-4c95-a361-8f4b2d0e9763
status: experimental
description: Detects browser or sandboxed renderer processes (Chrome, Edge, Firefox) whose crash involves NVIDIA user-mode driver modules. A sandboxed renderer crashing inside the graphics driver is a classic indicator of GPU-driver-based sandbox escape attempts such as GreenSection.
references:
  - https://securityaffairs.com/198589/hacking/chaotic-eclipse-released-a-poc-for-nvidia-greensection-memory-corruption-zero-day.html
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.defense_evasion
logsource:
  product: windows
  service: application
detection:
  selection_provider:
    Provider_Name: 'Application Error'
  selection_process:
    Message|contains:
      - 'chrome.exe'
      - 'msedge.exe'
      - 'firefox.exe'
  selection_module:
    Message|contains:
      - 'nvwgf2umx.dll'
      - 'nvd3dumx.dll'
      - 'nvoglv64.dll'
  condition: all of selection_*
falsepositives:
  - WebGL-heavy applications on unstable driver builds — treat repeat occurrences on the same host as high priority
level: high

// Hunt: Application crashes in NVIDIA user-mode driver modules (potential GreenSection exploitation)
// Surfaces faulting process, module, and crash frequency per host to identify clusters
let nvModules = dynamic(["nvwgf2umx.dll", "nvd3dumx.dll", "nvoglv64.dll", "nvoglv32.dll", "nvvkwddm.dll"]);
union isfuzzy=true
    (Event
    | where EventLog == "Application" and EventSourceName == "Application Error"
    | where RenderedDescription has_any (nvModules)
    | extend FaultingModule = extract(@"Faulting module name: ([^,\s]+)", 1, RenderedDescription),
             FaultingProcess = extract(@"Faulting application name: ([^,\s]+)", 1, RenderedDescription)
    | project TimeGenerated, Computer, FaultingProcess, FaultingModule, RenderedDescription),
    (DeviceEvents
    | where ActionType == "AppCrashEvent" or FileName in~ ("werfault.exe")
    | where InitiatingProcessCommandLine has_any (nvModules) or ProcessCommandLine has_any (nvModules)
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName)
| summarize CrashCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by Computer, FaultingProcess, FaultingModule
| extend RiskScore = case(
    FaultingProcess has_any ("chrome.exe", "msedge.exe", "firefox.exe") and CrashCount >= 2, "High - browser renderer crashing in GPU driver",
    CrashCount >= 5, "High - repeated driver crashes on single host",
    CrashCount >= 2, "Medium - recurring crash",
    "Low - single event")
| order by RiskScore desc, CrashCount desc;

-- GreenSection exposure scoping: NVIDIA user-mode driver inventory and crash artifact collection
-- 1) Identify installed NVIDIA display driver versions across endpoints
LET driver_files = SELECT FullPath, Mtime, Size,
       version(FullPath=FullPath) AS Version
FROM glob(globs=[
  'C:/Windows/System32/nvwgf2umx.dll',
  'C:/Windows/System32/nvd3dumx.dll',
  'C:/Windows/System32/nvoglv64.dll',
  'C:/Windows/System32/DriverStore/FileRepository/nv*/nvwgf2umx.dll'
])

-- 2) Check for recent Windows Error Reporting crash artifacts implicating NVIDIA modules
LET crash_artifacts = SELECT FullPath, Mtime, Size
FROM glob(globs=[
  'C:/ProgramData/Microsoft/Windows/WER/ReportArchive/**/*',
  'C:/Users/*/AppData/Local/Microsoft/Windows/WER/ReportArchive/**/*'
])
WHERE FullPath =~ '(?i)nvwgf2umx|nvd3dumx|nvoglv'
  AND Mtime > now() - 604800  -- last 7 days

SELECT * FROM driver_files
UNION ALL
SELECT * FROM crash_artifacts

# GreenSection NVIDIA driver exposure assessment - run elevated
# 1) Inventory NVIDIA user-mode driver modules and versions
Write-Host "=== NVIDIA User-Mode Driver Inventory ===" -ForegroundColor Cyan
$nvDlls = @("nvwgf2umx.dll","nvd3dumx.dll","nvoglv64.dll","nvoglv32.dll","nvvkwddm.dll")
foreach ($dll in $nvDlls) {
    $paths = @("$env:SystemRoot\System32\$dll")
    $paths += Get-ChildItem "$env:SystemRoot\System32\DriverStore\FileRepository" -Recurse -Filter $dll -ErrorAction SilentlyContinue | Select-Object -ExpandProperty FullName
    foreach ($p in $paths) {
        if (Test-Path $p) {
            $v = (Get-Item $p).VersionInfo
            "{0} | Version: {1} | Path: {2}" -f $dll, $v.FileVersion, $p
        }
    }
}

# 2) Query installed NVIDIA display driver version via WMI
Write-Host "`n=== Installed Display Driver ===" -ForegroundColor Cyan
Get-CimInstance Win32_VideoController | Where-Object { $_.Name -match "NVIDIA" } |
    Select-Object Name, DriverVersion, DriverDate | Format-List

# 3) Collect Application Error events implicating NVIDIA driver modules (last 14 days)
Write-Host "`n=== NVIDIA Module Crash Events (14 days) ===" -ForegroundColor Cyan
$since = (Get-Date).AddDays(-14)
$crashes = Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='Application Error'; StartTime=$since} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'nvwgf2umx|nvd3dumx|nvoglv|nvvkwddm' }
if ($crashes) {
    $crashes | Group-Object { ($_.Message -split "`n") -match 'Faulting application name' } |
        ForEach-Object { $_.Group | Select-Object TimeCreated, @{N='Summary';E={($_.Message -split "`r?`n")[0..3] -join ' | '}} } | Format-List
    Write-Host "ALERT: $($crashes.Count) crash event(s) in NVIDIA driver modules - investigate for PoC/exploit testing" -ForegroundColor Yellow
} else {
    Write-Host "No NVIDIA driver module crashes in window." -ForegroundColor Green
}

# 4) Flag hosts requiring action: driver older than latest NVIDIA security bulletin branch
#    Compare DriverVersion output above against https://www.nvidia.com/security/ advisories.