EUVD-2026-90186
GHSA-jmhw-f5vg-wxmc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-priv local/guest access
-
DeliveryIssue crafted request to vGPU kernel layer
-
ExploitTrigger out-of-bounds write (CWE-787)
-
ExecutionCorrupt kernel memory
-
ImpactExecute code / escalate privileges in kernel context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the NVIDIA vGPU Virtual GPU Manager (Windows or Linux) to be installed and running on the host, and the attacker must already hold low-privileged local execution (PR:L) to reach the kernel-mode layer - no network path and no user interaction (AV:L/UI:N). In vGPU/VDI/cloud-GPU deployments this realistically means a user inside a guest VM or a local unprivileged account on the host. Limiting factors: exploitation is local-only, needs valid low-level access, and depends on the vulnerable vGPU manager being deployed (not present on ordinary consumer GPU-driver installs); no non-default feature toggle is named in the description. |
| Impact | Real-world risk is MODERATE despite the 7.8 'High' CVSS. The vendor vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is internally consistent with a CWE-787 kernel out-of-bounds write reachable by an already-present low-privileged local user, and I independently agree with 7.8. The score is driven entirely by local access (AV:L) plus high triple impact, NOT by remote reachability - so the 'RCE' tag overstates real-world exposure. No EPSS probability, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active or automated exploitation; SSVC-style framing would put this at exploitation=none, automatable=no (local precondition), technical-impact=total. The genuine elevator for this class is deployment context: vGPU Virtual GPU Manager runs on hypervisor hosts serving multiple tenants/VMs, so an OOB write in the kernel-mode layer is a plausible guest-to-host or cross-tenant escape primitive in VDI/cloud-GPU fleets. Conflicting signal to flag: the 'Microsoft' tag is wrong (this is an NVIDIA product), and although the product covers Windows AND Linux, only a 'Linux' platform tag is present - verify platform scope before scoping remediation. |
| Exploit ScenarioDerived | An attacker with unprivileged local code execution inside a guest VM (or on the hypervisor host) issues crafted calls into the vGPU Virtual GPU Manager kernel-mode layer, triggering an out-of-bounds write that corrupts kernel memory. By shaping the overwrite, they escalate privileges or execute code in the kernel context, potentially breaking tenant isolation on a shared GPU host. No public exploit code is identified at time of analysis, and exploitation requires pre-existing local access, so this is not a remote drive-by. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
An out-of-bounds write in the kernel-mode layer of the NVIDIA vGPU Virtual GPU Manager for Windows and Linux allows a local attacker holding low privileges to corrupt kernel memory and potentially achieve code execution, privilege escalation, denial of service, information disclosure, and data tampering (CVSS 3.1 base 7.8). The flaw is local-only (AV:L) and requires an existing low-privileged foothold (PR:L) with no user interaction (UI:N); there is no public exploit identified at time of analysis and the package is not listed in CISA KEV. Although the numeric score is High, practical risk is assessed as MODERATE because exploitation demands local code execution on a host that specifically runs the vGPU manager - a component found in vGPU/VDI and cloud-GPU deployments rather than ordinary consumer driver installs.
RemediationAI
Primary remediation is to update the NVIDIA vGPU Virtual GPU Manager to a vendor-fixed release; since the input data does not include an exact patched version number and only points to the NVIDIA advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5861, obtain the precise affected-to-fixed version mapping from that advisory (and the mirrored NVD/CVE.org entries) rather than from generic version assumptions - patch status is therefore 'patch available per vendor advisory' with the specific patched build to be confirmed against NVIDIA's guidance. Until the fixed driver is deployed, apply targeted compensating controls that reflect the local, low-privilege prerequisite: strictly limit which accounts and guest VMs can interact with the vGPU host interfaces (restrict vGPU-capable VM provisioning and host logon rights to trusted administrators, and tightly control who can create or attach vGPU instances), since removing untrusted local access eliminates the only demonstrated attack path - at the cost of reduced VDI/cloud-GPU tenancy flexibility. Where the deployment permits, temporarily suspend or reconfigure vGPU-backed workloads on untrusted multi-tenant hosts, accepting a loss of GPU acceleration, and monitor host kernel logs for crashes or memory-corruption indicators as a detection backstop. Recommended hardening includes keeping hypervisor and host firmware current, disabling unnecessary vGPU management interfaces exposed to guest or non-administrative contexts, and treating any host that has run untrusted guest workloads as suspect until the vGPU Manager is upgraded.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in NVIDIA's Virtual GPU Manager, the host-side kernel driver that mediates GPU partitioning and scheduling for vGPU guests on hypervisors such as VMware ESXi, Citrix Hypervisor, KVM/RHEL and similar Windows/Linux host platforms. Its root cause is CWE-787 (out-of-bounds write): the kernel-mode component fails to correctly bound a write against the size of an allocated buffer, allowing memory corruption in kernel context. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a locally reachable attack path, no user interaction, and low privileges required - consistent with a guest-VM user or an unprivileged local account on the host reaching the driver through its exposed interfaces - with high confidentiality, integrity and availability impact scoped to the host. The accompanying tags (RCE, buffer overflow, memory corruption, denial of service, information disclosure) align with the description's stated outcomes of code execution, DoS, privilege escalation and data tampering, reflecting classic kernel-memory-corruption primitives rather than a remote or unauthenticated vector.
Know when Virtual Gpu Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-priv user triggers a kernel OOB write with no interaction; full kernel-context compromise gives high C/I/A, scope unchanged.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
DescriptionCVE.org
NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerability in the kernel mode layer where a user could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Articles & Coverage 3
Executive ViewAI
A high-severity out-of-bounds write in the kernel-mode layer of NVIDIA vGPU Virtual GPU Manager for Windows and Linux could allow an authenticated local low-privileged user to corrupt kernel memory, potentially leading to privilege escalation, code execution, denial of service, information disclosure, or data tampering on affected hosts. This matters most to organizations running vGPU/VDI or cloud-GPU infrastructure, where a single compromised low-privileged session could undermine host integrity and availability across shared GPU workloads. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis; leadership should prioritize exposure inventory, access restriction, and interim containment.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting local interactive logon and low-privileged account use on vGPU hosts, enforcing least privilege and removing unnecessary local users, segmenting vGPU/VDI/cloud-GPU hosts from general-purpose networks, monitoring for indicators of kernel memory corruption, privilege escalation, denial of service, information disclosure, or data tampering, engaging NVIDIA for a patch timeline, and applying the vendor patch immediately once available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Virtual Gpu Manager
View allLocal privilege escalation and code execution in the NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, an
An out-of-bounds read in the kernel-mode layer of NVIDIA GPU Display Driver on Windows and Linux allows a local, authent
Local privilege escalation and potential code execution in NVIDIA GPU Display Driver for Windows and Linux arise from a
Local privilege escalation in the kernel-mode layer of the NVIDIA GPU Display Driver for Linux allows an unprivileged lo
Privilege escalation in NVIDIA's GPU Display Driver for Windows lets a local, low-privileged authenticated user bypass a
Local privilege escalation in NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and Virtual GPU Manager b
Local privilege escalation in NVIDIA Display Driver for Windows (GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest/manager
Incorrect resource transfer between spheres in the NVIDIA vGPU Virtual GPU Manager for Linux allows a locally positioned
An out-of-bounds write in the kernel-mode layer of NVIDIA vGPU Virtual GPU Manager for Linux lets a local attacker with
Local privilege escalation, code execution, denial of service, and information disclosure affect Linux hosts running NVI
Local privilege escalation in NVIDIA vGPU Virtual GPU Manager for Linux stems from an out-of-bounds read in firmware (CW
Local attackers with low privileges on a Linux host running NVIDIA vGPU Virtual GPU Manager can trigger an out-of-bounds
Exploit-DB