nvflash.sys
NVIDIA NVFlash kernel driver (32-bit / legacy variant)
nvflash.sys is the older or 32-bit variant of NVIDIA NVFlash, NVIDIA's GPU BIOS flashing utility. The 64-bit variant nvflsh64.sysDrivernvflsh64.sysNVIDIA NVFlash GPU BIOS toolOpen plate → is curated separately; both ship from the same NVIDIA tool that technicians, GPU repair shops, and enthusiast overclockers use to read, back up, or modify the video BIOS on GeForce and RTX cards.
The driver is on the public LOLDrivers list for the same family of reasons as the motherboard BIOS-tool drivers already in the Field Guide (AMI, Phoenix, Insyde, Toshiba, HP/Compaq): writing a video BIOS requires the kind of low-level hardware access a kernel-level attacker would also want. No public CVE has been assigned to this specific variant as of this writing.
If you find it on your system and you did not run a GPU BIOS flash on purpose, the leftover NVFlash install can be removed. Microsoft's Vulnerable Driver Blocklist blocks the older signed builds from loading.
nvflash.sys is listed as a known-vulnerable driver on the public LOLDrivers project. One distinct binary hash matching this filename is on record.
Status data comes from the public LOLDrivers project, a community-curated registry of drivers known to be vulnerable or malicious. The snapshot Vera uses was refreshed July 10, 2026. CVE links go to the NIST National Vulnerability Database.
Vera Project. “nvflash.sys.” Vera Field Guide (Driver). The Vera Project. https://www.veraproject.xyz/field-guide/drivers/nvflash-sys