NVIDIA Display Driver CVE-2026-47547

Exploitation requires local access to a system running the NVIDIA GPU Display Driver for Windows or Linux (GeForce, RTX/Quadro/NVS, or Tesla product lines) AND pre-existing HIGH privileges (PR:H) on that host - the attacker must already be able to reach the privileged firmware input path. No user interaction is needed (UI:N) and no scope change occurs (S:U). The malformed-input trigger is against the GPU firmware validation logic. Limiting factors: this is not remotely reachable (AV:L), cannot be performed by an unprivileged local user, and requires the NVIDIA driver to be installed - so it is realistically a post-compromise privilege/kernel-boundary escalation rather than an initial-access vector.

This is a moderate-priority local vulnerability, not a high-real-risk one, despite the alarming impact list. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U) confirms the attack is LOCAL and requires HIGH privileges - the attacker must already hold administrative/elevated access on the host to reach the vulnerable firmware input-validation path. This materially caps the 6.7 (Medium) score; the PR:H requirement is the dominant limiting factor and distinguishes this CVE from its many PR:L siblings in the same NVIDIA bulletin (5861). No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation status is: no public exploit identified at time of analysis. The 'RCE' tag overstates reality - with AV:L this is local code execution, not remote. There is no SSVC data provided. Net: the full-CIA impact (C:H/I:H/A:H) looks severe, but the PR:H precondition means an attacker already needs significant access, making this a defense-in-depth / privilege-boundary hardening patch rather than an urgent externally-facing emergency. Note a tag-quality conflict: the record carries a 'Microsoft' vendor tag, which is incorrect - this is an NVIDIA product affecting both Windows and Linux.

An attacker who has already obtained high/administrative privileges on a Windows or Linux machine with an NVIDIA GPU driver installed submits malformed input to the GPU firmware interface, exploiting the improper input validation (CWE-20) to trigger memory corruption. This could escalate into kernel-level code execution, crash the display driver (DoS), leak memory contents, or tamper with GPU state. No public exploit code is known, and the high-privilege prerequisite limits this to post-compromise or insider scenarios.