NVIDIA GPU Driver EUVD-2026-90102

Exploitation requires local access to a system running the NVIDIA GPU Display Driver (Windows or Linux) with an affected GeForce, RTX/Quadro/NVS, or Tesla GPU, or the vGPU/Virtual GPU Manager component; the attacker must already hold low-privilege execution (PR:L) to reach the vulnerable kernel-mode interface. No user interaction is needed (UI:N) and complexity is low (AC:L). The key LIMITING factor is that this is not remotely exploitable (AV:L) - an attacker must first have a foothold on the host - which confines it to local privilege escalation and sandbox-escape scenarios rather than remote mass exploitation.

This is a genuine local privilege-escalation priority despite lacking exploitation signals. The CVSS 7.8 (HIGH) vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a low-privileged local attacker triggering an out-of-bounds write (CWE-787) in the kernel-mode layer of the NVIDIA GPU Display Driver, yielding full C:H/I:H/A:H impact - consistent with kernel memory corruption that escalates to SYSTEM/root. Attack vector is LOCAL (AV:L) with low complexity (AC:L) and no user interaction (UI:N), so any code already running on the host (a logged-in user, a sandboxed process, or malware) can attempt it. No EPSS score, CISA KEV listing, or public POC was provided, so there is no evidence of active exploitation; this is a vendor-reported (NVIDIA product-security) issue rather than an in-the-wild threat. No SSVC decision data was supplied. The absence of a network vector meaningfully lowers mass-exploitation risk, but because kernel driver bugs are a favored local-EoP and sandbox-escape primitive and the affected drivers are extremely widely deployed, this warrants prompt patching. No conflicting signals were detected in the provided data beyond the mislabeled 'Microsoft' vendor tag (see data_quality_flags).

A low-privileged user or a process that has already achieved limited code execution on a Windows or Linux host with an NVIDIA GPU issues crafted requests (e.g., via IOCTLs/ioctls) to the kernel-mode driver, triggering an out-of-bounds write that corrupts kernel memory. By controlling the overwrite, the attacker escalates to SYSTEM/root, enabling full compromise, or alternatively crashes the driver for denial of service. No public exploit code was identified at the time of analysis, and exploitation requires local access.