NVIDIA Display Driver CVE-2026-47505

Requires local code execution on a Windows host that has the affected NVIDIA GPU Display Driver (GeForce, RTX/Quadro/NVS, or Tesla branches) installed, plus a low-privileged account or sandboxed process able to open a handle to and issue calls against the kernel-mode driver interface. Per the CPE and tags, the vGPU/Guest Driver and Virtual GPU Manager components are also in scope, so a guest in a virtual-GPU deployment could target the kernel layer. Limiting factors: no remote vector (AV:L - must already be on the machine), and PR:L authentication is needed; there is no user interaction requirement (UI:N) and complexity is low (AC:L), so once local access exists the barrier is small. Hosts without an NVIDIA GPU/driver installed are unaffected.

This is a genuine, actionable local privilege-escalation risk rather than an inflated high-CVSS score. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) is internally consistent with the CWE-416 use-after-free in the kernel-mode layer of the NVIDIA GPU Display Driver: a UAF in ring-0 code plausibly yields full C:H/I:H/A:H because arbitrary kernel memory corruption can escalate to SYSTEM. The local attack vector (AV:L) and required low privileges (PR:L) mean this is a post-compromise escalation primitive, not a remotely reachable flaw, which correctly moderates the score into the High (not Critical) band. No EPSS score, KEV listing, or public PoC was provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' The absence of KEV/EPSS/PoC signals is consistent with a vendor-reported (NVIDIA product-security) memory-corruption bug patched proactively rather than one under active attack. Kernel UAFs are historically weaponizable by skilled attackers, so the practical risk is meaningful for multi-user or sandbox-escape scenarios even without confirmed exploitation. Note the description also lists 'code execution' and 'information disclosure' as possible impacts; the CVSS treats these as the local-scope C/I/A:H outcome (S:U), meaning impact stays within the compromised OS rather than crossing a security boundary to another system.

A low-privileged local user (or code running in a sandbox/guest) on a Windows machine with the affected NVIDIA driver installed issues crafted IOCTLs/API calls to the kernel-mode driver to trigger a use-after-free, then grooms the freed kernel allocation to hijack control flow or corrupt kernel structures. Successful exploitation escalates to SYSTEM, enables kernel code execution, or crashes the host (DoS). No public exploit code was identified in the provided data, and no user interaction is required (UI:N).