NVIDIA Display Driver CVE-2026-47579

Requires local access to a Windows host running an affected NVIDIA GPU Display Driver (GeForce, RTX/Quadro/NVS, or Tesla) and an already-authenticated low-privileged user account (PR:L, AV:L) that can invoke the kernel-mode driver. Exploitation is further limited by high attack complexity (AC:H): the use-after-free (CWE-416) depends on winning a race or precise kernel-pool reclamation, so reliable exploitation is non-trivial. No user interaction is needed (UI:N), and no network exposure applies - this cannot be triggered remotely. Highest-value targets are shared/multi-user, VDI, or cloud-GPU deployments where local low-priv-to-SYSTEM escalation crosses a trust boundary.

This is a genuine but not top-tier priority - it rates 7.8 (HIGH) on CVSS 3.1, yet every signal points to a local privilege-escalation class issue rather than a wormable remote threat. The vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H requires local access (AV:L) and already-held low privileges (PR:L), and notably carries AC:H - high attack complexity, typical of use-after-free bugs that depend on winning a timing/allocation race in the kernel-mode driver. The scope change (S:C) plus full C:H/I:H/A:H is what drags the base score up to 7.8 despite the local, complex, authenticated preconditions. No EPSS probability, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation - treat exploitation status as no public exploit identified at time of analysis. The 'RCE' tag overstates the reachability: with AV:L this is local code execution / privilege escalation, not network RCE. Net: patch on a normal cadence; prioritize on multi-user, VDI, or cloud-GPU hosts where a low-priv local user gaining SYSTEM matters most.

A low-privileged local user on a Windows host with an NVIDIA GPU driver issues crafted calls to the kernel-mode driver to trigger a use-after-free, then grooms the kernel pool to reclaim the freed object and hijack execution. Because AC:H, success depends on winning a race/allocation condition, but a reliable exploit would yield kernel code execution and SYSTEM-level privilege escalation. No public POC is referenced at time of analysis.