NVIDIA Display Driver CVE-2026-47593

Requires local access with an authenticated low-privileged account (PR:L) on a Windows host that has the NVIDIA GPU Display Driver installed (GeForce, RTX/Quadro/NVS, or Tesla, including the Guest Driver in virtualized deployments). No user interaction and low attack complexity once local access is obtained, but exploitation is NOT remote - an attacker must already be able to run code on the machine. This makes the flaw most relevant to shared/multi-tenant systems (VDI, cloud GPU instances, terminal servers) where untrusted users hold low-privileged sessions; single-user workstations with no untrusted local access have materially lower exposure.

This is a genuine but bounded privilege-escalation risk, not a remote-compromise emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U, 7.8 HIGH) is internally consistent with the description: a LOCAL, low-privileged (PR:L) user triggers a kernel-mode out-of-bounds write with low attack complexity and no user interaction, yielding full C:H/I:H/A:H on the affected host. The 'RCE' tag overstates this - with AV:L there is no network vector; realistic outcome is local code execution in kernel context (privesc) or a bugcheck/DoS. No EPSS score, KEV listing, POC, or SSVC data was provided, so there is no evidence of active or automated exploitation; kernel stack-overflow (CWE-121) exploitation for reliable code execution on modern Windows is non-trivial (kernel mitigations like stack cookies/CFG), which tempers real-world weaponization likelihood despite AC:L. Priority is moderate: patch as part of normal cycles, prioritizing multi-user, VDI, and cloud-GPU hosts where untrusted low-privileged users share the machine. The 'Microsoft' vendor tag is incorrect - this is an NVIDIA product flaw that merely runs on the Windows platform.

A low-privileged local user (or malware already running under a standard account) on a Windows workstation or GPU server with the NVIDIA display driver installed issues crafted requests to the kernel-mode driver, overflowing a stack buffer to write out of bounds in kernel memory. By controlling the overwrite, the attacker escalates to SYSTEM/kernel privileges or crashes the host (DoS). No public exploit code was identified at time of analysis.