NVIDIA GPU Driver EUVD-2026-90100

Requires the attacker to already possess local, authenticated low-privilege code execution on a system running the NVIDIA GPU Display Driver (kernel-mode layer) - the vector is AV:L/PR:L, so there is no remote or unauthenticated path and no user interaction is needed. Exploitation is against default driver installations (no special feature flag or non-default configuration is named in the description), affecting GeForce, RTX/Quadro/NVS, and Tesla product lines on both Windows and Linux. The limiting factor is the local-access prerequisite: the attacker needs a foothold (interactive login, sandboxed process, or existing malware) before the kernel stack exposure can be triggered.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally-exploitable flaw requiring existing low-privilege code execution on the host - not a remote or network-facing issue, which meaningfully caps real-world urgency. There is a notable internal tension: the CWE is CWE-200 (Information Exposure) and the description's concrete primitive is a leak of kernel stack contents (return addresses and pointers), yet NVIDIA scores full C:H/I:H/A:H by aggregating the speculative worst-case chain ('might lead to code execution, DoS, escalation of privileges, information disclosure, and data tampering'). This is NVIDIA's customary conservative worst-case scoring; the directly demonstrated impact is high-value information disclosure (KASLR/stack-canary bypass material) rather than confirmed I:H/A:H. No EPSS score, KEV listing, or public POC was provided in the input, so exploitation signals are absent. SSVC framing: exploitation status is 'none' observed, and while the driver footprint is large, the local-access precondition makes this a patch-in-normal-cycle item rather than an emergency - its main danger is as a reliable primitive within a larger local privilege-escalation chain, not as a standalone break.

A local attacker who already has the ability to run unprivileged code (a logged-in user, a sandboxed process, or malware) issues a crafted ioctl/system call to the NVIDIA kernel-mode driver that returns uninitialized or over-read kernel stack memory. The leaked return addresses and pointers let the attacker defeat KASLR and stack protections, which they then chain into a separate memory-corruption bug to escalate to kernel privileges. No public exploit code was identified at time of analysis.