NVIDIA Display Driver CVE-2026-47570

Requires local low-privileged access to a host running the NVIDIA GPU Display Driver for Windows with the affected CUDA driver component (GeForce, RTX/Quadro/NVS, Tesla, or vGPU guest_driver branches). The attacker must be able to write a malicious library into a directory that the CUDA driver's uncontrolled search path resolves before the legitimate library, and the vulnerable library-loading code path must execute. Exploitation is LIMITED by the local attack vector (AV:L) - no remote or network exploitation is possible - and the need for pre-existing low-privilege code execution on the target; it is most relevant on shared, multi-user, VDI/vGPU, or cloud-GPU hosts where an untrusted local user coexists with the driver.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8, HIGH) describes a locally-exploitable uncontrolled-search-path/DLL-loading flaw (CWE-427) in the CUDA driver component of the NVIDIA GPU Display Driver for Windows, requiring only low local privileges and no user interaction, but yielding full confidentiality, integrity, and availability impact - consistent with a privilege-escalation-to-SYSTEM or code-execution-in-driver-context outcome. No EPSS score, CISA KEV entry, POC, or SSVC decision-point data is present in the input, so there is no signal of active or probable exploitation; the risk is elevated because the flaw is real and the product is widely deployed, but tempered by the AV:L local-access requirement which rules out remote mass exploitation. The 'RCE' tag should be read in the local context - code execution here means running in the driver/library-loading process locally, not remote code execution, since the CVSS vector is unambiguously AV:L; treat the 'RCE' tag as potentially misleading versus the local vector. This is a solid patch-soon issue for multi-user, VDI/vGPU (note guest_driver CPEs), and shared GPU/cloud hosts rather than an emergency, and the vendor-assigned score aligns with an independent read of the description.

A low-privileged local user on a Windows workstation or a multi-tenant/vGPU guest with the NVIDIA driver installed plants a malicious DLL in a directory that appears earlier in the CUDA driver's uncontrolled library search path. When the CUDA driver subsequently loads the library, the attacker's DLL is loaded instead, executing attacker code with the driver's elevated privileges. No public exploit has been identified at time of analysis, and exploitation requires local access to the target host.