EUVD-2026-31934
GHSA-mp9c-jx49-947f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain low-priv local account on vGPU host
-
DeliveryIdentify vulnerable vGPU Manager branch
-
ExploitInvoke racing vGPU control calls
-
InstallTrigger stack use-after-free
-
C2Reclaim freed slot with controlled data
-
ExecuteHijack execution in vGPU Manager
-
ImpactEscalate to hypervisor-level code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must already have local, low-privilege authenticated access to a system running NVIDIA Virtual GPU Manager in one of the listed vulnerable branches (vGPU 16.x ≤16.13, 19.4, 20.0, or the March 2026 595.58.02 release), and the host must be deployed in vGPU sharing mode with the manager active - pure GPU-passthrough hosts without vGPU Manager loaded are not in scope. No user interaction is required, but the High attack complexity reflects that the use-after-free is a race or timing-dependent condition on stack memory that the attacker must reliably win, limiting opportunistic exploitation; the bug is not reachable from the network. |
| Impact | The CVSS 7.0 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) signals a high-impact but hard-to-reach bug: local access, high attack complexity, and low-privilege authentication required, with no scope change despite the hypervisor context - which is worth questioning since a guest-to-host break would typically warrant S:C. EPSS of 0.01% (1st percentile) and SSVC Exploitation:none / Automatable:no align with the lack of any public POC and indicate this is not currently a mass-exploitation candidate. However, SSVC Technical Impact:total combined with the privileged role of vGPU Manager means a working exploit would be highly damaging in multi-tenant GPU clouds, AI/ML hosting, and VDI environments - so prioritization should be driven by deployment exposure (multi-tenant or shared-GPU hosts) rather than EPSS alone. No CISA KEV listing. |
| Exploit ScenarioDerived | An attacker who has gained low-privilege local access on a hypervisor host (or, plausibly, controls a guest VM whose vGPU calls reach the manager) repeatedly invokes a specific vGPU control path to win a race that frees a stack-tracked object and then references it, corrupting the manager's stack memory to redirect execution at hypervisor privilege. Because attack complexity is High, the exploit likely requires precise timing or a heap/stack-grooming primitive, which matches the SSVC 'not automatable' rating; no public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Local privilege escalation and code execution in NVIDIA Virtual GPU Manager arises from a use-after-free on stack memory within the vGPU hypervisor component. Authenticated local attackers on the host or guest side of an affected vGPU deployment (vGPU branches 16.x through 20.x) can trigger memory corruption that may yield DoS, info disclosure, data tampering, or arbitrary code execution. No public exploit identified at time of analysis and EPSS is 0.01%, but SSVC rates technical impact as total.
RemediationAI
Patch available per vendor advisory - apply the fixed vGPU Manager driver branches published in NVIDIA security bulletin 5821 (https://nvidia.custhelp.com/app/answers/detail/a_id/5821); exact post-fix version strings were not independently confirmed from the supplied data, so consult the bulletin for the patched build that supersedes 535.288.01 (16.x), 580.126.08/582.16 (19.4), 595.94 (20.0), and 595.58.02 (March 2026). Until hypervisor hosts can be drained and rebooted into the patched driver, compensating controls include restricting which tenants/admins can obtain low-privilege execution on hosts running vGPU Manager, segregating high-trust and low-trust workloads onto separate GPU hosts (side effect: capacity fragmentation), and disabling vGPU profiles on hosts that do not require GPU sharing in favor of GPU passthrough (side effect: loss of multi-tenant density). Cross-reference https://vuldb.com/vuln/365767 and https://www.cve.org/CVERecord?id=CVE-2026-24200 for tracking.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NVIDIA Virtual GPU Manager is the host-side hypervisor component (typically loaded as a kernel/VMM module on ESXi, KVM, Citrix Hypervisor, or Nutanix AHV) that mediates partitioning of physical NVIDIA GPUs into multiple vGPU instances assigned to guest VMs. The flaw is classified CWE-416 (Use After Free), specifically against a stack-allocated object - meaning a freed reference is dereferenced after its lifetime ends, allowing controlled reuse of that memory region. Because the manager runs at hypervisor privilege and the affected CPEs all point at cpe:2.3:a:nvidia:virtual_gpu_manager, successful corruption directly threatens VM isolation and host integrity.
Know when Virtual Gpu Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (nvidia) · only source for this CVE.
CVSS VectorVendor: nvidia
DescriptionCVE.org
NVIDIA vGPU software contains a vulnerability in the virtual GPU manager, where an attacker could cause a use-after-free for stack memory. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code execution.
Executive ViewAI
NVIDIA Virtual GPU Manager (versions 16.x-20.x) contains a local privilege escalation vulnerability in the vGPU hypervisor allowing authenticated local attackers to execute arbitrary code and compromise GPU isolation controls. Organizations deploying NVIDIA vGPU in cloud infrastructure and data centers face potential breach of guest isolation and unauthorized access to GPU resources across multiple virtual instances. No vendor patch is currently available, necessitating immediate tactical remediation.
No vendor-released patch identified at time of analysis. Restrict local privileged account access to hypervisor hosts; implement kernel-level detection for privilege escalation; enforce network segmentation of vGPU deployments; disable extraneous local management interfaces until patch release. Maintain watch on NVIDIA security bulletins for patch availability and prioritize patching upon release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Virtual Gpu Manager
View allLocal privilege escalation and code execution in the NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, an
An out-of-bounds read in the kernel-mode layer of NVIDIA GPU Display Driver on Windows and Linux allows a local, authent
Local privilege escalation and potential code execution in NVIDIA GPU Display Driver for Windows and Linux arise from a
Local privilege escalation in the kernel-mode layer of the NVIDIA GPU Display Driver for Linux allows an unprivileged lo
Privilege escalation in NVIDIA's GPU Display Driver for Windows lets a local, low-privileged authenticated user bypass a
Local privilege escalation in NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and Virtual GPU Manager b
Local privilege escalation in NVIDIA Display Driver for Windows (GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest/manager
Incorrect resource transfer between spheres in the NVIDIA vGPU Virtual GPU Manager for Linux allows a locally positioned
An out-of-bounds write in the kernel-mode layer of NVIDIA vGPU Virtual GPU Manager for Linux lets a local attacker with
Local privilege escalation, code execution, denial of service, and information disclosure affect Linux hosts running NVI
Local privilege escalation in NVIDIA vGPU Virtual GPU Manager for Linux stems from an out-of-bounds read in firmware (CW
Local attackers with low privileges on a Linux host running NVIDIA vGPU Virtual GPU Manager can trigger an out-of-bounds
Exploit-DB