NVIDIA Display Driver CVE-2026-47506

Requires local access with low privileges (PR:L) to a Windows system running an affected NVIDIA GPU Display Driver, and the ability to trigger the kernel-mode color-transform path that evaluates YCbCr420 display emulation. Limiting factors: no remote vector (AV:L), no user interaction of a victim needed but attacker must already be authenticated on the host, and impact is capped at denial of service (no confidentiality or integrity effect). Affected versions include GeForce/RTX/Quadro/NVS/Tesla branches prior to the 582.78 / 596.86 / 610.60 / 610.88 / 616.56 / 616.92 fixed builds (per EUVD-2026-90169); GeForce is limited to Maxwell, Volta, and Pascal architectures on the 582.78 branch.

This is a genuinely low-priority issue despite a moderate 5.5 CVSS. The vendor vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is internally consistent with the description: local attack vector, low privileges, and availability-only impact (C:N/I:N/A:H). The CWE-121 stack-overflow classification is somewhat misleading here - the description specifies 'excessive kernel stack use' (stack depth exhaustion), not a controllable out-of-bounds write, which is why the stated impact ceiling is denial of service rather than code execution or privilege escalation. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC data supplied. The signals are not conflicting - they consistently point to a local, low-impact (crash/DoS only) bug requiring an already-authenticated foothold. This is a high-CVSS-relative-to-real-risk item: real-world urgency is low because it cannot cross a confidentiality or integrity boundary and requires local access.

A local low-privileged user on a Windows host with an affected NVIDIA GPU driver crafts or triggers a display/color-transform operation exercising the YCbCr420 display-emulation path, causing unbounded kernel stack usage that exhausts the stack and crashes the driver/system. No public exploit code is known, and the attacker gains only a denial of service (system crash), not code execution or data access.