NVIDIA Display Driver EUVD-2026-90096

Requires local access with the ability to run code at low privilege on a host with a vulnerable NVIDIA GPU Display Driver installed (Windows or Linux; GeForce, RTX/Quadro/NVS, or Tesla). The attacker must reach the kernel-mode layer's request interface (driver IOCTL/syscall surface) and supply crafted values that cause the integer overflow (CWE-190) and resulting out-of-bounds write. Limiting factors: no remote network vector (AV:L) - the attacker must already have a foothold on the machine; PR:L means an authenticated/local unprivileged account is needed; no user interaction is required (UI:N). The 'Guest Driver' tag indicates VM guests with GPU access are also in scope, extending the primitive to guest-to-host or in-guest EoP contexts where GPU virtualization is configured.

This is a genuine local privilege-escalation priority rather than an inflated high-CVSS finding. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a kernel-mode integer overflow leading to an out-of-bounds write to GPU memory, with full C:H/I:H/A:H impact - consistent with the described potential for code execution, denial of service, privilege escalation, information disclosure, and data tampering. The signals are internally consistent: the vector is LOCAL (AV:L) with low complexity and requires only low privileges (PR:L, i.e., any user who can reach the driver's IOCTL/syscall surface), no user interaction, and scope unchanged (kernel compromise within the same host boundary). No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis'; there is no SSVC decision data supplied. The absence of KEV/EPSS/POC lowers immediate real-world urgency, but the ubiquity of NVIDIA drivers and the reliability of GPU-driver kernel bugs as EoP primitives means this should be patched promptly on multi-user and sandboxed hosts. No conflicting signals were found between the CVSS vector and the description - both point to a local, low-privilege kernel memory-corruption flaw.

A local attacker with an unprivileged account (or code running inside a low-integrity sandbox or a VM guest using GPU passthrough) invokes a crafted request to the vulnerable NVIDIA kernel-mode driver, supplying values that trigger an integer overflow and a controlled out-of-bounds write into GPU/kernel memory. By shaping the overflow, the attacker corrupts kernel structures to escalate to SYSTEM/root or crashes the machine for denial of service. No public exploit code was identified at time of analysis, but GPU-driver kernel write primitives are historically weaponizable.