NVIDIA Display Driver CVE-2026-47581

Requires local access to a Windows system running the affected NVIDIA GPU Display Driver, plus existing low-level privileges (PR:L) sufficient to issue requests to the kernel module - no user interaction is needed (UI:N) and no authentication bypass is involved. Exploitation is limited to a local attacker: there is no network vector, and the impact is confined to denial of service (driver/display crash or hang) with no data disclosure or modification. Most relevant on shared, multi-user, VDI, or cloud-GPU Windows hosts where one low-privileged user can degrade availability for others; single-user desktops face self-inflicted DoS only.

This is a genuinely low-to-moderate priority issue despite affecting a ubiquitous driver family. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) constrains impact to availability only - there is no confidentiality or integrity loss - and requires local access with existing low privileges. CWE-667 (improper locking) is consistent with a DoS outcome such as a deadlock, hang, or crash rather than memory corruption leading to code execution. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis. No SSVC fields were supplied. Signals are internally consistent: a local-only, availability-only, low-privilege bug in a kernel driver is a stability/reliability concern (e.g., forcing GPU/display crashes on shared or multi-user hosts) rather than a widespread exploitation threat. No conflicting data was observed between the CVSS vector and the description - both indicate local access and DoS impact.

A local low-privileged user on a Windows host (e.g., a standard user or a tenant on a shared/VDI GPU workstation) issues a crafted sequence of calls to the NVIDIA kernel module that triggers the improper-locking condition, causing a deadlock or crash of the GPU driver. The result is loss of display/GPU services or a system hang affecting all users of that machine. No public exploit code is known, and the attacker gains no data access or elevated privileges - only denial of service.