NVIDIA GPU Driver EUVD-2026-90108

Requires local access with an unprivileged (standard user) account on a Windows host running an affected NVIDIA GPU Display Driver (GeForce, RTX/Quadro/NVS, Tesla, or vGPU/Virtual GPU Manager). Exploitation is limited by the local-only attack vector (AV:L) - no remote or network path exists; the attacker must already be able to run code on the machine and interact with the kernel-mode driver interface. No user interaction and no elevated privileges beyond a normal local account are needed (UI:N, PR:L), and default driver installations are affected, making this a strong privilege-escalation primitive on multi-user or shared/virtualized GPU hosts.

This is a genuine, actionable local privilege-escalation class issue rather than a CVSS-inflated paper risk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 HIGH) is internally consistent with the description: an unprivileged local user (PR:L) triggers an untrusted-pointer dereference in the kernel-mode layer with low complexity (AC:L) and no user interaction (UI:N), yielding full CIA impact including possible code execution in kernel context. The local attack vector (AV:L) is the single most important limiting factor - there is no remote/network exploitation path, so this is an escalation primitive for an attacker who already has code execution on the host, not an initial-access vulnerability. No EPSS score, SSVC decision data, KEV entry, or public POC was supplied in the intelligence; on the available signals the exploitation status is 'no public exploit identified at time of analysis.' Note the tags list 'RCE' but the CVSS vector is AV:L, so any 'code execution' here is LOCAL kernel code execution, not remote - treat the RCE tag as local-context only. NVIDIA is the reporting vendor and the fix is published via their product-security advisory tree, so the vulnerability is confirmed by the vendor. Overall: patch-worthy on multi-tenant, shared, or VDI/vGPU hosts where local attackers are in the threat model; lower urgency on single-user workstations where the attacker would already need a foothold.

A low-privileged user (or malware already running as a standard user) on a Windows machine with the NVIDIA GPU display driver opens a handle to the driver and issues a crafted IOCTL/request containing an attacker-controlled untrusted pointer. The kernel-mode layer dereferences that pointer without validation, letting the attacker corrupt kernel memory to escalate to SYSTEM, crash the host, or read kernel data. No public exploit code was identified in the provided data, and exploitation requires prior local access.