What is the CVSS score of CVE-2026-24201?

CVE-2026-24201 has a CVSS 3.1 base score of 5.8 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H. EPSS exploitation probability: 0.0%.

NVIDIA vGPU Manager CVE-2026-24201

EUVD-2026-31935 MEDIUM

Out-of-bounds Write (CWE-787)

2026-05-26 nvidia

GHSA-5jr9-f23j-wrrp

Nvidia Memory Corruption Information Disclosure Buffer Overflow Denial Of Service Virtual Gpu Manager

5.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.8 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:35 vuln.today

DescriptionCVE.org

NVIDIA vGPU software contains a vulnerability in the virtual GPU manager, where an attacker could cause an out-of-bound access. A successful exploit of this vulnerability might lead to data tampering, denial of service, or information disclosure.

AnalysisAI

Out-of-bounds write in NVIDIA Virtual GPU Manager exposes virtualized GPU deployments to denial of service, data tampering, and information disclosure. A local, low-privileged attacker operating within a virtualized environment can trigger the memory corruption flaw in the host-side vGPU manager component across multiple affected driver branches (vGPU 16.x through 20.x). No public exploit code exists at time of analysis, and EPSS probability is at the 2nd percentile, but the high availability impact (A:H in CVSS) and the prevalence of vGPU in enterprise virtualization infrastructure warrant prompt patching.

Technical ContextAI

NVIDIA Virtual GPU Manager (vGPU Manager) is a host-side software component that mediates GPU resource sharing across virtual machines in VMware vSphere, Citrix Hypervisor, and KVM-based environments. CWE-787 (Out-of-bounds Write) is the root cause - attacker-controlled input causes the manager process to write beyond the allocated buffer boundary, corrupting adjacent memory. This class of bug typically arises in parsing or handling of guest-initiated requests or driver IOCTLs. The CPE string cpe:2.3:a:nvidia:virtual_gpu_manager:*:*:*:*:*:*:*:* confirms the flaw is in the vGPU Manager application layer rather than the bare-metal NVIDIA display driver. Tags confirm Memory Corruption and Buffer Overflow characteristics consistent with CWE-787. The CVSS vector AV:L/AC:H/PR:L indicates the attacker must have a foothold inside the host or guest environment, and exploitation requires a specific, reproducible set of conditions (AC:H), elevating the difficulty beyond commodity exploitation.

RemediationAI

The primary remediation is to upgrade NVIDIA Virtual GPU Manager to a version beyond the affected ranges documented in EUVD-2026-31935. Consult the NVIDIA Product Security advisory at https://nvidia.custhelp.com/app/answers/detail/a_id/5821 for exact patched build numbers per driver branch, as the provided data confirms affected-through versions but does not enumerate explicit fixed release identifiers. For deployments that cannot patch immediately, compensating controls include restricting access to the vGPU-enabled host to trusted, explicitly authorized users only - reducing the pool of potential local attackers - and enabling hypervisor-level monitoring for anomalous vGPU Manager process behavior or unexpected crashes. Given AV:L and PR:L, network-level controls alone are insufficient; access to guest VMs or the hypervisor host itself must be hardened. Note that restricting guest VM user privileges may introduce operational friction in VDI or ML workload environments. No workaround that eliminates the vulnerability without patching has been identified from available data.