NVIDIA Display Driver CVE-2026-47528

Requires local access to a host running the affected NVIDIA GPU Display Driver or Virtual GPU Manager on Windows or Linux, with the attacker holding at least low-privilege (PR:L) authenticated access to reach the vulnerable firmware code path. No user interaction is needed (UI:N). Exploitation is limited to local vectors (AV:L) - there is no remote/network exposure - and requires the vulnerable driver to be installed and the specific firmware interface reachable from the attacker's privilege level. Applies to GeForce, RTX/Quadro/NVS, and Tesla product lines including vGPU Manager deployments.

This is a genuine patch-priority issue for environments running NVIDIA GPUs, but not an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) describes a local attack requiring only low privileges and no user interaction, with full high impact across confidentiality, integrity and availability - consistent with a firmware/driver-level uninitialized-pointer flaw (CWE-824) that can escalate an already-authenticated local user. No EPSS score, KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the requirement for local access materially limits mass or remote exploitation. The signals are internally consistent: local vector matches a driver/firmware weakness, and the absence of exploitation telemetry aligns with a vendor-self-reported bug. The main uncertainty is impact breadth - NVIDIA lists code execution, DoS, privilege escalation, information disclosure and data tampering as possible but not confirmed outcomes ('might lead to'), so C:H/I:H/A:H represents a worst-case ceiling rather than a demonstrated result.

A local attacker who already has an unprivileged account or code execution on a Windows or Linux host with the vulnerable NVIDIA GPU Display Driver (or vGPU Manager) triggers the firmware code path that dereferences an uninitialized pointer, corrupting driver/kernel memory. By controlling the memory the pointer resolves to, the attacker escalates to elevated privileges or executes code in the driver context. No public exploit code is currently identified.