EUVD-2026-90060
GHSA-xqcj-gh86-6hwh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain user access on guest VM
-
DeliveryCraft malformed RPC message
-
ExploitSend to host GSP plugin
-
ExecutionTrigger out-of-bounds write
-
PersistCorrupt vGPU Manager memory
-
ImpactExecute code / escalate / crash host GPU service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated user on a guest VM (PR:L) within an NVIDIA vGPU deployment, plus the ability to send RPC messages to the host's GSP (GPU System Processor) plugin - i.e., the vGPU Manager must be running on the hypervisor host serving that guest. The vulnerable path is the GSP plugin's handling of guest-supplied RPC messages. Exploitation is bounded by AV:L (local to the guest, not network-reachable from outside), no user interaction is needed (UI:N), and AC:L means no special timing/config beyond an operable vGPU guest. It is not exploitable against hosts not running vGPU or against a guest the attacker cannot access. |
| Impact | Moderate, locally-scoped risk requiring an authenticated foothold. The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8, HIGH) is AV:L - local - so despite the 'RCE' tag this is NOT a remotely-reachable flaw; the 'RCE' tag is loose given AV:L. The meaningful nuance is the attack surface: a guest VM user sends a crafted RPC to the host's GSP plugin, so the true value of this bug is a guest-to-host / cross-tenant boundary crossing in virtualized GPU deployments, even though S:U indicates the vendor did not score it as a formal scope change. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or imminent exploitation - this is a patch-on-normal-cycle item, not a fire drill, but its priority rises in multi-tenant vGPU/VDI/cloud-GPU environments where the guest is inherently attacker-controlled. No SSVC decision data was supplied. Signals are consistent (local vector, authenticated guest, memory-corruption class); nothing conflicts. |
| Exploit ScenarioDerived | An attacker who already controls or has an account on a guest VM in a vGPU deployment crafts a malformed RPC message and sends it to the GPU System Processor (GSP) plugin in the host-side vGPU Manager, triggering an out-of-bounds write. By shaping the overwrite, the attacker corrupts host memory to escalate privileges, execute code in the manager context, or crash the GPU service, potentially undermining tenant isolation. No public exploit code was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
An out-of-bounds write in NVIDIA vGPU Manager's GPU System Processor (GSP) plugin lets an authenticated user inside a guest VM hit host-side plugin code with a specially crafted RPC message, potentially yielding code execution, privilege escalation, data tampering, denial of service, or information disclosure in the virtualization host stack. The practical barrier is an existing foothold in an authorized vGPU guest rather than network reachability, and no public exploit code has been identified at time of analysis. Scoring 7.8 under CVSS 3.1 (AV:L/AC:L/PR:L/UI:N, with high confidentiality, integrity, and availability impact) it represents a Moderate, locally-scoped risk that matters most in multi-tenant vGPU deployments where guest-to-host isolation is a core control.
RemediationAI
Apply the patched NVIDIA vGPU Manager / vGPU host driver release documented in NVIDIA's security bulletin for this CVE (https://github.com/NVIDIA/product-security/tree/main/2026/5861; NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-47498) - note that the exact fixed version number is not stated in the supplied data, so consult the advisory to select the correct driver branch; patch availability is per the vendor advisory rather than a version confirmed in this dataset. Because the fix is a host GPU driver update, plan for the required hypervisor reboot and guest evacuation, which is the main operational cost. Where patching cannot be scheduled immediately, reduce exposure with compensating controls: restrict vGPU profiles to trusted, single-tenant guests so that a compromised guest does not become a guest-to-host escalation path (trade-off: eliminates multi-tenancy density benefits); disable vGPU on hosts where virtual GPU acceleration is not strictly required, thereby removing the GSP plugin attack surface (trade-off: loss of GPU acceleration for VDI/ML workloads); segment and tightly control which tenants can submit RPC traffic through the vGPU stack and monitor host logs for unexpected GSP plugin faults or host crashes, which may indicate exploitation attempts (trade-off: monitoring is detective, not preventive, and adds operational overhead). There is no user-facing configuration that disables only the vulnerable RPC path without also disabling vGPU functionality, so driver upgrade on the host remains the primary remediation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NVIDIA vGPU Manager runs on the hypervisor host and mediates access to the physical GPU's GPU System Processor (GSP) for guests configured with virtual GPU profiles; the 'GSP plugin' component processes RPC (remote procedure call) messages that originate from guest VM users and are relayed to host-side plugin logic. This vulnerability is CWE-787 (out-of-bounds write): the plugin fails to adequately validate the size or offset fields of a guest-supplied RPC payload before copying it into a fixed-size buffer, so a crafted message can write past the intended bounds of host-side memory, corrupting adjacent data and enabling code execution, data tampering, denial of service, or information disclosure. The supplied CPE data enumerates four entries all matching cpe:2.3:a:nvidia:virtual_gpu_manager with wildcard version fields, confirming the affected product is the vGPU Manager component itself; the wildcarding means the supplied data does not pin individual release ranges, so applicability must be confirmed against NVIDIA's bulletin. The attack is not remotely reachable from outside the host - it requires an attacker who already operates inside a guest that has been granted a vGPU profile and whose RPC traffic reaches the host's GSP plugin - which is why the assessed vector is AV:L/PR:L rather than AV:N.
Know when Virtual Gpu Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Authenticated guest user (PR:L) triggers OOB write via local RPC path (AV:L/AC:L/UI:N); memory corruption yields full C/I/A impact; vendor scored S:U despite the guest-to-host crossing.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
DescriptionCVE.org
NVIDIA vGPU Manager contains a vulnerability in the GPU System Processor (GSP) plugin where a guest VM user may cause an out-of-bounds write by sending a specially crafted RPC message. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.
Articles & Coverage 1
Executive ViewAI
A high-severity out-of-bounds write in NVIDIA vGPU Manager can let an authenticated local user in a vGPU guest reach host-side GPU System Processor plugin code and potentially execute code, escalate privileges, tamper with data, cause denial of service, or disclose information in the virtualization host stack. This matters most to organizations running multi-tenant vGPU environments such as VDI, cloud gaming, AI/ML workstations, or GPU-accelerated remote desktops, where a guest foothold could undermine guest-to-host isolation and affect other tenants or host infrastructure. There is no public exploit identified at time of analysis, but no vendor-released patch identified at time of analysis, so leadership should treat this as a high-priority risk-reduction item.
No vendor-released patch identified at time of analysis. Interim mitigations include limiting vGPU access to trusted tenants, minimizing guest-user privileges, monitoring host-side GSP plugin and RPC activity, isolating multi-tenant vGPU workloads on dedicated hosts or segments, maintaining hypervisor hardening and backups, and requesting hotfix or mitigation guidance from NVIDIA support.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Virtual Gpu Manager
View allLocal privilege escalation and code execution in the NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, an
An out-of-bounds read in the kernel-mode layer of NVIDIA GPU Display Driver on Windows and Linux allows a local, authent
Local privilege escalation and potential code execution in NVIDIA GPU Display Driver for Windows and Linux arise from a
Local privilege escalation in the kernel-mode layer of the NVIDIA GPU Display Driver for Linux allows an unprivileged lo
Privilege escalation in NVIDIA's GPU Display Driver for Windows lets a local, low-privileged authenticated user bypass a
Local privilege escalation in NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and Virtual GPU Manager b
Local privilege escalation in NVIDIA Display Driver for Windows (GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest/manager
Incorrect resource transfer between spheres in the NVIDIA vGPU Virtual GPU Manager for Linux allows a locally positioned
An out-of-bounds write in the kernel-mode layer of NVIDIA vGPU Virtual GPU Manager for Linux lets a local attacker with
Local privilege escalation, code execution, denial of service, and information disclosure affect Linux hosts running NVI
Local privilege escalation in NVIDIA vGPU Virtual GPU Manager for Linux stems from an out-of-bounds read in firmware (CW
Local attackers with low privileges on a Linux host running NVIDIA vGPU Virtual GPU Manager can trigger an out-of-bounds
Exploit-DB