NVIDIA Display Driver CVE-2026-47545

Requires the attacker to already have local, low-privileged code execution on a host running a vulnerable NVIDIA GPU Display Driver (GeForce, RTX/Quadro/NVS, Tesla, or Virtual GPU Manager) on Windows or Linux; exploitation is performed against the kernel-mode driver layer via crafted calls/IOCTLs. No user interaction is needed (UI:N). Limiting factors: there is NO remote/network attack surface (AV:L) - the bug cannot be triggered across the network, so it functions as a local privilege-escalation/DoS/info-leak primitive that presupposes an initial foothold; scope is unchanged (S:U), and full code-execution/EoP outcomes are vendor-described as possible rather than guaranteed for an out-of-bounds read.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally-exploitable, low-privilege, no-user-interaction flaw in the NVIDIA GPU Display Driver kernel-mode layer (CWE-125 out-of-bounds read). Local vector (AV:L) means the attacker must already be able to run code on the host - this is a privilege-escalation/local-impact bug, not a remotely reachable one, which materially lowers its real-world urgency versus a network-facing critical. That said, the high triple-impact (C:H/I:H/A:H) reflects NVIDIA's own worst-case framing that an OOB read 'might lead to' code execution, DoS, privilege escalation, information disclosure, and data tampering - note the conditional language: a pure OOB read most reliably yields information disclosure and DoS, while full code execution/EoP is possible but not guaranteed, so the C:H/I:H assignment is optimistic-worst-case rather than demonstrated. No EPSS score, no CISA KEV listing, and no public PoC were provided, so there is no evidence of active or imminent exploitation. No SSVC decision data was supplied. Overall: a legitimate patch-worthy local kernel driver bug (very large install base amplifies aggregate exposure), but not an emergency - no public exploit identified at time of analysis and exploitation requires prior local access.

A low-privileged local user (or malware already running in a user-level context) on a Windows or Linux host with a vulnerable NVIDIA GPU driver issues crafted calls/IOCTLs to the kernel-mode driver, triggering an out-of-bounds read. Depending on adjacent memory layout, this leaks kernel memory (information disclosure) or corrupts driver state, potentially escalating to SYSTEM/root code execution or crashing the host (DoS). No public proof-of-concept exploit was identified at time of analysis.