NVIDIA Display Driver EUVD-2025-209936

Exploitation requires local access to the target system and a highly privileged account (PR:H per CVSS - e.g., local administrator on Windows or root/sudo on Linux). No network access path exists (AV:L). The affected system must have one of the vulnerable NVIDIA driver versions installed with a GeForce (Maxwell, Volta, or Pascal architecture on certain branches), RTX/Quadro/NVS, Tesla, or Guest (vGPU) GPU. No user interaction is required once the attacker has the necessary privilege level. Factors that limit exploitation: (1) High privilege requirement means the attacker already has significant system control, reducing incremental impact; (2) No scope change (S:U) means the vulnerability does not break out of the driver's security boundary to affect other system components; (3) Confidentiality is not impacted (C:N); (4) Integrity impact claimed in the description conflicts with CVSS I:N scoring - verify with vendor before treating data tampering as a confirmed outcome.

Real-world risk is low-to-moderate. The CVSS 4.4 score is grounded in an attack vector of Local (AV:L) with High privileges required (PR:H), meaning an attacker must already have administrative or kernel-level access to the target system - substantially limiting the exploitable population. EPSS is 0.01% at the 0th percentile, indicating near-zero observed exploitation probability across the broader threat landscape. SSVC confirms: exploitation status none, not automatable, technical impact partial. One noteworthy discrepancy exists: the CVE description claims potential 'data tampering,' but the CVSS vector records I:N (no integrity impact), with only A:H (availability) scored - security teams should verify with the NVIDIA advisory at nvidia.custhelp.com/app/answers/detail/a_id/5821 whether integrity impact is realistically achievable or was conservatively excluded from scoring. The vulnerability is not in CISA KEV and no public exploit code has been identified, confirming this is a theoretical local privilege-abuse scenario rather than an active threat.

A local administrator or kernel-privileged user on a Windows or Linux system running an affected NVIDIA driver submits a crafted request to the kernel driver interface, triggering improper input validation that causes incorrect permissions to be set on a critical GPU or driver-managed resource. This results in denial of service - such as a driver crash, GPU reset, or system hang - potentially disrupting any workloads dependent on the GPU. No public exploit code exists at time of analysis, making opportunistic exploitation unlikely.