NVIDIA GPU Driver EUVD-2026-90104

Requires local access to a system running the NVIDIA GPU Display Driver (GeForce, RTX/Quadro/NVS, or Tesla) on Windows or Linux, plus a low-privileged authenticated account able to issue calls (e.g., IOCTLs) to the kernel-mode driver - no user interaction and no special non-default configuration are needed since the vulnerable kernel-mode layer ships and loads by default when the driver is installed. Exploitation is LIMITED by the local-only attack vector (no remote/network path), the need for pre-existing code execution as a standard user, and the practical difficulty of turning an OOB write into reliable kernel code execution, which depends on driver version and OS memory-management specifics.

This is a genuine, high-priority patch-management item for any NVIDIA GPU-equipped host, though not an emergency. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a local, low-complexity, low-privilege out-of-bounds write in the kernel mode layer that yields full C/I/A impact - the classic local privilege-escalation profile where an already-present low-privileged user gains kernel/SYSTEM-level code execution. The AV:L vector means this is NOT remotely exploitable and cannot be triggered by an unauthenticated network attacker, which meaningfully caps its urgency versus a remote flaw of the same score. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or automated weaponization at this time. Signals are internally consistent: a local memory-corruption bug reported by the vendor (NVIDIA) with no exploitation telemetry - real risk is driven by prevalence and the reliability of kernel OOB-write primitives, not by observed attacks. The RCE tag should be read in context: 'code execution' here is local kernel code execution (LPE), not remote code execution, despite the AV:L vector.

A local, low-privileged user (or malware already running under a standard user account) invokes a crafted IOCTL/API call into the NVIDIA kernel-mode driver, triggering an out-of-bounds write that corrupts kernel memory. By shaping kernel objects around the corrupted region, the attacker converts the write primitive into kernel-mode code execution or a controlled data overwrite, escalating from standard user to SYSTEM/root. No public exploit code was identified at time of analysis, and exploitation requires prior local access plus reliable heap/pool grooming.