NVIDIA Display Driver EUVD-2026-31929

| CVE-2026-24193 HIGH

Out-of-bounds Write (CWE-787)

2026-05-26 nvidia

GHSA-7gvm-xr2x-wg8x

Nvidia Memory Corruption RCE Information Disclosure Microsoft Buffer Overflow Denial Of Service Geforce Rtx Quadro Nvs Tesla

7.8

CVSS 3.1 · Vendor: nvidia

Share

Severity by source

Vendor (nvidia) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from Vendor (nvidia).

CVSS VectorVendor: nvidia

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

2

Analysis Generated

Jun 08, 2026 - 10:33 vuln.today

CVE Published

May 26, 2026 - 17:21 nvd

HIGH 7.8

DescriptionCVE.org

NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code execution.

AnalysisAI

Local privilege escalation in the NVIDIA Display Driver for Windows and Linux allows an authenticated low-privileged user to trigger an out-of-bounds write (CWE-787) in the kernel-mode driver, potentially leading to code execution, privilege escalation, information disclosure, data tampering, or denial of service. The flaw affects GeForce, RTX/Quadro/NVS, and Tesla product lines, with NVIDIA confirming the vulnerability and releasing patched driver versions. No public exploit identified at time of analysis, and EPSS rates exploitation probability at just 0.01%.

Technical ContextAI

NVIDIA's Display Driver provides kernel-mode components on both Windows (nvlddmkm.sys family) and Linux (nvidia.ko) that handle GPU command submission, memory management, and display output. CWE-787 (Out-of-bounds Write) in this context typically arises from missing or incorrect bounds checks when parsing user-supplied data passed via IOCTLs or system calls from user-mode GPU APIs (e.g., DirectX, Vulkan, CUDA) into kernel-mode handlers. Because the driver runs in ring-0, a memory corruption primitive there can be leveraged to overwrite kernel structures and elevate privileges. The CPE list spans nvidia:geforce, nvidia:rtx,_quadro,_nvs, and nvidia:tesla product families, indicating the defect lives in shared driver code used across consumer, workstation, and datacenter GPUs - though the EUVD note clarifies that for GeForce on the 582.53 branch only Maxwell, Volta, and Pascal architectures are affected.

RemediationAI

Vendor-released patches are available from NVIDIA - upgrade to driver branch 535.309.01, 539.72, 580.159.03, or 582.53 (whichever corresponds to the supported branch for your GPU family and operating system) as documented in NVIDIA Security Bulletin ID 5821 (https://nvidia.custhelp.com/app/answers/detail/a_id/5821). On Windows, deploy via GeForce Experience, the NVIDIA Enterprise driver installer, or vendor OEM channels; on Linux, install the updated package from your distribution's repository or NVIDIA's run-file for the matching branch and reboot to load the new kernel module. Where immediate patching is not possible, compensating controls should focus on the local-attacker prerequisite: restrict interactive and remote-code-execution access for non-administrative users on systems with the affected driver (particularly multi-tenant VDI, ML training nodes, and render farms), enforce application allowlisting to limit which processes can call into the GPU driver interface, and use EDR rules to alert on unusual IOCTL patterns against the NVIDIA driver - note these controls reduce but do not eliminate risk and can break legitimate GPU workloads if overly restrictive.

More in Geforce

View all

CVE-2026-24187 HIGH This Week

Local privilege escalation and code execution in the NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, an

CVE-2026-24192 HIGH This Week

Local privilege escalation in NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and Virtual GPU Manager b

CVE-2026-24191 HIGH This Week

Local privilege escalation in NVIDIA Display Driver for Windows (GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest/manager

CVE-2026-24194 HIGH This Week

Local privilege escalation in NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest drivers) a

CVE-2026-24190 HIGH This Week

Local privilege escalation in NVIDIA Display Driver for Windows and Linux allows authenticated low-privilege users to im

CVE-2026-24196 HIGH This Week

Out-of-bounds read in NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and vGPU Guest drivers) allows a

CVE-2026-24197 MEDIUM This Month

NVIDIA Display Driver for Linux exposes a denial-of-service condition in the Multi-Instance GPU (MIG) partition manageme

CVE-2026-24182 MEDIUM This Month

Denial of service in NVIDIA Display Driver for Windows and Linux stems from improper lock management (CWE-667), where an

CVE-2025-33221 MEDIUM This Month

Incorrect permission assignment in the NVIDIA Display Driver kernel module on Windows and Linux allows a highly privileg

CVE-2026-24198 MEDIUM This Month

Race condition in NVIDIA GPU Display Driver for Linux allows a high-privileged local attacker to leak sensitive kernel o

CVE-2026-24199 MEDIUM This Month

Race condition exploitation in NVIDIA Display Driver's Linux kernel module allows a local authenticated user to cause de

Same weakness CWE-787 – Out-of-bounds Write

View all

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2012-1889 HIGH POC

CVE-2010-3333 HIGH POC

CVE-2014-1761 HIGH POC

CVE-2009-3129 HIGH POC

CVE-2021-1732 HIGH POC

CVE-2013-3346 CRITICAL POC

Same technique Memory Corruption

View all

CVE-2015-5119 CRITICAL POC

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2011-0611 HIGH POC

CVE-2014-0322 HIGH POC

CVE-2012-1889 HIGH POC

CVE-2012-4792 HIGH POC

CVE-2010-3333 HIGH POC

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed
SUSE Linux Enterprise Micro 5.3	Fixed

Share

EUVD-2026-31929 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy