NVIDIA Display Driver EUVD-2026-90111

Exploitation requires the attacker to already have unprivileged local access (an interactive session or local code execution) on a host running the affected NVIDIA GPU Display Driver, and the ability to reach the driver's kernel-mode interface - which any local user process can normally do on systems with the GPU driver installed. No special non-default configuration is called out in the description, and no user interaction is needed (UI:N). The principal limiting factor is the local attack vector (AV:L): there is no remote or network-facing exposure, so the flaw serves as a local privilege-escalation primitive rather than an initial-access vector. Affected platforms are Windows and Linux systems using GeForce, RTX/Quadro/NVS, or Tesla drivers.

This is a genuine local privilege-escalation priority despite modest headline positioning. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 High) is internally consistent with the description: a locally-present, already-authenticated unprivileged user triggers a kernel-mode out-of-bounds write (CWE-787) with no user interaction and low complexity, yielding full C/I/A impact. Because the flaw sits in the kernel-mode layer of the GPU driver, successful exploitation crosses the user-to-kernel trust boundary - the classic LPE pattern. No EPSS score, KEV listing, or POC is present in the provided data, so exploitation status is 'no public exploit identified at time of analysis'; this is not evidence of active exploitation, only that none is reported here. The main factor tempering urgency is AV:L - the attacker must already have code-execution/a foothold on the host, so this is a second-stage escalation primitive rather than a remote entry point. No SSVC decision data was supplied. The signals are consistent (no conflicts), so the realistic verdict is a solid, patch-promptly LPE on a very widely deployed component, but not an internet-facing emergency.

An attacker who already has a low-privileged shell on a Windows or Linux workstation or GPU server - via phishing, a compromised service account, or a malicious local application - invokes a crafted ioctl/API call to the NVIDIA kernel-mode driver that triggers the out-of-bounds write. By shaping the corrupted kernel memory they escalate to SYSTEM/root, achieving code execution and full control of the host. No public exploit code is identified in the provided data, and no user interaction is required (UI:N).