NVIDIA Display Driver EUVD-2026-31929

Local code execution on the target host is required (CVSS AV:L) with at least low-privileged authenticated access (PR:L) - meaning the attacker must already be able to run code as a standard user and open a handle to the NVIDIA kernel driver. The vulnerable system must have a pre-patch NVIDIA Display Driver installed (GeForce, RTX/Quadro/NVS, or Tesla branch below the fixed versions listed above) on Windows or Linux; for GeForce on the 582.53 branch, the GPU must specifically be based on Maxwell, Volta, or Pascal architecture. No user interaction by a second party is required (UI:N), no network access is needed, and the scope remains unchanged (S:U) - limiting reach to the local host but yielding total compromise of that host. Systems without an NVIDIA GPU/driver loaded, or with the patched driver branch installed, are not exploitable.

CVSS 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H places this as a classic local privilege escalation: an attacker must already have low-privileged code execution on the host, but exploitation is low-complexity and yields total compromise (high CIA impact). SSVC corroborates this - Exploitation status is 'none', Automatable is 'no' (consistent with a local LPE that needs per-target tuning of memory corruption primitives), but Technical Impact is 'total'. EPSS at 0.01% (1st percentile) and absence from CISA KEV indicate no observed in-the-wild abuse, and no public exploit identified at time of analysis. Real-world priority is moderate: critical for multi-tenant or shared-workstation environments (VDI, render farms, ML training hosts, shared HPC nodes) where an unprivileged tenant gaining kernel code execution is a tenancy break, but lower for single-user endpoints where the attacker would already need a foothold. The signals are consistent - no conflicts between CVSS, EPSS, KEV, and SSVC.

An attacker who has already obtained a low-privileged shell on a shared GPU workstation (e.g., a researcher on a multi-tenant ML training box or a standard domain user on a CAD workstation) opens a handle to the NVIDIA driver and issues a crafted GPU command or IOCTL whose size or offset field triggers the out-of-bounds write in kernel memory. By grooming kernel objects in advance, they corrupt a process token or function pointer to gain SYSTEM (Windows) or root (Linux) execution. No user interaction by another party is required (UI:N), and complexity is low (AC:L), though no public exploit code has been published.