NVIDIA GPU Display Driver EUVD-2026-90095

Requires local access to a system running the affected NVIDIA GPU Display Driver (Windows or Linux) with at least low-level user privileges (PR:L); the attacker interacts with the kernel-mode driver layer to trigger the flawed numeric conversion. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Exploitation is LIMITED by the local attack vector - there is no network-facing path - and by the need for a valid local foothold. Risk is materially higher on shared or multi-tenant GPU hosts (VDI, Virtual GPU Manager/vGPU, Tesla datacenter deployments) where untrusted users can reach the driver, and lower on single-user workstations where the attacker would already control the account.

This is a credible local privilege escalation / kernel-corruption issue that warrants prioritized patching on any host with NVIDIA GPUs, but it is not an unauthenticated remote emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) tells a consistent story: the attacker must already have local access and low-level privileges, but once present the attack is low-complexity, needs no user interaction, and yields full confidentiality, integrity and availability impact - the classic profile of an OS/kernel EoP. CWE-681 (incorrect numeric-type conversion) in the kernel-mode driver layer is a well-understood bug class that can be driven into memory corruption via crafted ioctl/API calls. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is 'no public exploit identified at time of analysis'; this should be read as pre-exploitation rather than proof of low risk, because driver EoP bugs are attractive sandbox-escape and post-compromise targets. The 'RCE' tag overstates reach - the CVSS vector is firmly local (AV:L), so treat 'code execution' as local kernel-mode code execution, not network RCE. Net: real priority for multi-user, VDI, virtual-GPU and shared-GPU/datacenter hosts where untrusted users share hardware; lower urgency for single-user workstations already under the user's control.

A low-privileged local user (or a process that has escaped into a low-trust context, e.g. a browser/renderer sandbox or a guest workload on a shared vGPU host) issues a crafted request to the NVIDIA kernel-mode driver that triggers the incorrect numeric-type conversion. The resulting miscalculation corrupts kernel memory, which the attacker leverages to execute code in kernel context and escalate to SYSTEM/root, or alternatively to crash the driver for denial of service. No public exploit code was identified at time of analysis, and no user interaction is required.