NVIDIA Display Driver EUVD-2026-31930

The attacker must already have local interactive or remote-shell access to the host as an authenticated low-privileged user (CVSS PR:L) and the system must be running a vulnerable NVIDIA display driver version with the kernel module loaded and a supported GPU present; on GeForce hardware exploitation is further limited to GPUs built on the Maxwell, Volta, or Pascal architectures. No user interaction from another user is required (UI:N), and no special non-default driver configuration is mentioned in the advisory - a stock driver install on an affected GPU is sufficient. The attack vector is local (AV:L), so purely remote network-only attackers without a foothold cannot trigger this directly; multi-tenant GPU hosts, VDI environments, and shared workstations are the highest-risk deployments.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a local, low-complexity attack requiring only low privileges and no user interaction, with total impact on confidentiality, integrity, and availability - consistent with the SSVC 'total' technical impact rating. However, SSVC marks Exploitation as 'none' and Automatable as 'no', and the EPSS score of 0.01% (1st percentile) indicates negligible observed exploitation likelihood; the CVE is not in CISA KEV. The realistic threat is therefore an insider or post-compromise privilege escalation primitive rather than a remotely weaponizable bug - high impact if abused, but low probability of opportunistic exploitation. Note the 'RCE' and 'Authentication Bypass' tags in the source data are misleading shorthand: the CVSS vector clearly indicates LOCAL access with PR:L (authenticated low-priv user), not remote unauthenticated code execution; defenders should treat this as an LPE issue, not a network-exploitable RCE.

A low-privileged local user (for example, a standard domain account on a shared workstation, a CI runner with GPU access, or a tenant on a multi-user VDI or GPU-accelerated compute node) executes a small user-mode program that issues crafted IOCTLs to the NVIDIA kernel driver to reach an unauthorized GPU resource operation. By manipulating that operation, the attacker corrupts kernel memory or GPU state to escalate to SYSTEM/root, read other users' GPU buffers, or crash the host. No public exploit has been identified at time of analysis.