NVIDIA GPU Driver CVE-2026-47589

Requires local, authenticated access as an unprivileged user on a Windows or Linux host running the affected NVIDIA GPU Display Driver (GeForce, RTX/Quadro/NVS, or Tesla lines); the attacker must be able to interact with the GPU driver's device interface to issue the specific driver-command sequence that induces the use-after-free. No special non-default product configuration is called out in the description, but exploitation is limited by the need for prior local code execution (PR:L, AV:L) and by the practical difficulty of turning a kernel UAF into reliable code execution (heap grooming, driver-version-specific offsets). There is no remote attack surface and no user interaction (UI:N). Risk concentrates on multi-user or shared-GPU environments - VDI, terminal servers, and cloud/virtualized GPU hosts - where untrusted low-privilege users run on the same machine.

This is a genuine but bounded local privilege-escalation/memory-corruption issue, not an internet-facing emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) is internally consistent and I agree with it: an already-authenticated low-privileged local user triggers a kernel-mode use-after-free (CWE-416) by issuing a crafted sequence of driver commands, with no user interaction and full C/I/A impact on the host. No EPSS score, CISA KEV listing, or public POC is provided in the input, so there is no signal of active or imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' UAF-to-kernel-code-execution on a GPU driver is real but non-trivial to weaponize reliably (heap grooming, versioned offsets), which tempers the 7.8 despite the high impact metrics. The 'RCE' tag conflicts with the vector: AV:L means local, not remote - code execution here is local privilege escalation, not remote code execution, so do not triage this as a remotely reachable flaw. NVIDIA is the reporter and has published a fix (product-security bulletin 5861), so patch availability is confirmed. Net: a medium-priority patch-management item, elevated where many low-trust users share GPU hosts (VDI, multi-tenant/cloud GPU, shared workstations).

A low-privileged local user (or malicious process) on a Windows or Linux machine running the affected NVIDIA GPU Display Driver issues a specific sequence of driver commands (e.g., via IOCTLs/ioctls to the driver device) that drives a kernel object into a use-after-free state. By controlling reallocation of the freed object, the attacker corrupts kernel memory to escalate to SYSTEM/root or crash the host. No public exploit code is identified in the provided data, and exploitation requires local access plus non-trivial kernel heap manipulation.