New GPUThor Attack Bypasses Nvidia ECC Defenses on Workstation GPUs

A team of academic researchers from the University of Toronto has detailed a new hardware vulnerability dubbed GPUThor that circumvents the primary defense mechanism recommended by Nvidia to protect its enterprise graphics processors against memory corruption attacks. The breakthrough demonstrates that Error-Correcting Code (ECC) memory, long positioned by Nvidia as a sufficient safeguard against hardware-level bit flipping, can be bypassed on widely used workstation graphics cards.

The findings, authored by Chris S. Lin, Joyce Qu, Aditya Rajeev, and Gururaj Saileshwar, target Nvidia's Ampere-generation professional GPUs equipped with GDDR6 memory, including the RTX A4000, A4500, A5000, and A6000 models. By executing an unprivileged CUDA program, the researchers demonstrated that an attacker could exploit these hardware flaws to gain a root shell on the host system, opening up pathways for sandbox escapes, unauthorized data tampering, and system-wide privilege escalation.

At its core, GPUThor relies on a Rowhammer attack vector, a technique where memory cells in a DRAM chip are rapidly and repeatedly accessed until electrical charge leaks into adjacent physical rows, altering stored binary data. While modern ECC-enabled graphics hardware incorporates Target Row Refresh (TRR) mitigations to track access frequency and refresh neighboring cells before corruption occurs, GPUThor employs a non-uniform pattern of memory requests. This non-uniform hammering strategy effectively blinds hardware counters and prevents TRR from triggering defensive refreshes.

GPUThor marks the third GPU-focused hardware exploit disclosed by essentially the same research group over the past 18 months, following the discovery of GPUHammer in 2025 and GPUBreach earlier this year. Unlike its predecessors, which were completely neutralized whenever administrators toggled on ECC memory settings, GPUThor successfully penetrates active ECC protections. The breakthrough elevates GPU-based DRAM vulnerabilities to a level of severity previously seen only on system CPUs, such as the well-documented Blacksmith attack against DDR4 memory.

Testing conducted across four Ampere-based workstation models revealed that with ECC disabled, GPUThor generated between 72,000 and 377,000 bit flips per gigabyte of memory, as first reported by TechRadar Pro. The Nvidia RTX A5000 proved to be the most susceptible card in the lineup. These figures approach the roughly 550,000 bit flips per gigabyte achieved by CPU-level Blacksmith attacks, illustrating that GPU memory architectures share similar fundamental hardware vulnerabilities.

Even when ECC was activated, the researchers found that the protective measures failed to fully remediate the issue. Instead of preventing corruption, GPUThor induced double-bit errors and led to miscorrections on two triple-bit errors where the hardware applied incorrect values. On an RTX A6000 with ECC turned on, the attack pattern triggered a full GPU hardware reset every two hours, aborting all active computational tasks running on the card. Within a single day of sustained exploitation, the targeted GPU flagged itself as requiring a return merchandise authorization (RMA).

The research group privately disclosed the attack vectors to Nvidia on April 29, 2026, and subsequently shared their findings with major cloud infrastructure providers including Google, Microsoft, and Amazon Web Services. The team maintained an embargo on public disclosure until August 25, 2026, with full source code slated for public release on November 15, 2026. The technical paper outlining the exploit will be presented at the ACM CCS 2026 conference. At present, no Common Vulnerabilities and Exposures (CVE) identifier has been assigned, and no software or firmware patch has been deployed to address the vulnerability.