NVIDIA Display Driver CVE-2026-47578

Requires the NVIDIA GPU Display Driver for Windows (GeForce, RTX/Quadro/NVS, Tesla, or vGPU/Virtual GPU Manager) to be installed, plus pre-existing local low-privileged code execution on the host (PR:L, AV:L). No user interaction and low attack complexity once that foothold exists. Exploitation is LIMITED to local attackers - there is no network vector - so it cannot be triggered remotely and is only relevant where an untrusted party can already run code, e.g. shared workstations, multi-tenant vGPU/VDI, or cloud-GPU nodes.

This is a genuine but locally-scoped privilege-escalation class issue, not a remotely-wormable emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U, C:H/I:H/A:H, base 7.8) confirms the attacker must already have local, low-privileged code execution on the host - this is NOT a remote attack despite the 'RCE' tag. Attack complexity is low and no user interaction is required, so once an attacker has a foothold the kernel-mode buffer miscalculation (CWE-131) is straightforward to trigger. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so there is no evidence of active exploitation or automation. The realistic risk is a reliable local privilege-escalation primitive for an attacker who already has unprivileged access - valuable as a second-stage/LPE step, especially on shared or virtualized GPU hosts (vGPU Manager is in scope), but low urgency for single-user desktops. The 'RCE' tag overstates reach (the vector is AV:L), and the 'Microsoft' tag is misattributed - this is an NVIDIA driver flaw.

A low-privileged local user (or malware already running in a standard user context) on a Windows machine with the NVIDIA GPU display driver issues a crafted request to the kernel-mode driver interface that causes an incorrect buffer size calculation, corrupting kernel memory to escalate to SYSTEM or crash the host. On a multi-tenant vGPU/VDI or cloud-GPU host this lets one tenant attack the hypervisor host or other tenants. No public exploit code is identified at time of analysis, and exploitation requires pre-existing local access.