NVIDIA Display Driver EUVD-2026-90094

Requires local access with at least low-privileged code execution on a host running the vulnerable NVIDIA GPU Display Driver kernel-mode layer (GeForce, RTX/Quadro/NVS, Tesla) on Windows or Linux, or on a Virtual GPU Manager host where a guest can reach the driver. The attacker must be able to invoke the affected kernel-mode interface and pass a controlled out-of-range array index (CWE-129). Limiting factors: exploitation is strictly local (AV:L) - there is no network/remote path - and needs valid low-privilege access (PR:L); however, no user interaction (UI:N) and low complexity (AC:L) mean any unprivileged local process qualifies. No special non-default configuration is called out beyond having the GPU driver / vGPU Manager installed.

This is a genuine, high-priority local privilege-escalation class flaw despite lacking remote reach. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a low-complexity attack requiring only local, low-privilege access and no user interaction, yielding full confidentiality/integrity/availability impact - the signature of kernel-mode code execution from an unprivileged user context. No EPSS score, CISA KEV entry, or public POC was provided in the intelligence set, so there is no evidence of active or automated exploitation at this time; the finding is vendor-reported (NVIDIA product-security advisory 5861) rather than exploitation-driven. The description's enumeration of possible outcomes (code execution, DoS, EoP, information disclosure, data tampering) is characteristic of NVIDIA's broad worst-case phrasing for a CWE-129 improper-array-index bug, not confirmation that all impacts are reliably achievable. Net: real priority for patching on multi-user, VDI, sandboxed, and datacenter/vGPU hosts where a local attacker's escape to kernel matters most, but not an emergency internet-facing exposure. No signals are internally conflicting; the main gap is the absence of EPSS/KEV/POC data, which limits exploitation-likelihood scoring.

A local, low-privileged user (or malicious/compromised process, including a guest VM on a vGPU host) issues a crafted request to the NVIDIA kernel-mode driver that supplies an out-of-range array index, triggering an out-of-bounds access in kernel context. By controlling the OOB read/write, the attacker corrupts kernel memory to escalate to SYSTEM/root, or at minimum crashes the driver for denial of service. No public exploit code was identified in the provided data, and no user interaction is required.