NVIDIA GPU Driver EUVD-2026-90112

Requires local access with an existing low-privilege account or code execution on a host running the affected NVIDIA GPU Display Driver (GeForce, RTX/Quadro/NVS, or Tesla) on Windows or Linux; the attacker must be able to reach the vulnerable kernel-mode driver interface (installed by default whenever the GPU driver is present). No user interaction and no elevated privileges are needed beyond that unprivileged foothold. Limiting factors: exploitation is strictly local (not remotely reachable over a network), requires the NVIDIA driver to be installed and the specific vulnerable code path to be invocable, and is bounded to the affected driver branches - patched/unaffected driver versions and hosts without NVIDIA GPUs are not exploitable.

This is a genuine, actionable local privilege-escalation-class flaw despite lacking sensational exploitation signals. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 High) tells the real story: exploitation requires local access and a low-privilege foothold (PR:L) but no user interaction and low complexity, and yields full C:H/I:H/A:H impact - consistent with an integer overflow (CWE-190) producing a kernel-mode out-of-bounds write, which typically escalates an unprivileged user to kernel/SYSTEM. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent widespread exploitation. However, kernel-mode GPU driver bugs of this shape are historically attractive LPE primitives (used as sandbox-escape and post-compromise escalation steps), so the low EPSS/KEV signal reflects 'not yet weaponized publicly' rather than 'low real risk.' No signals conflict: the description ('unprivileged user', 'kernel mode layer') aligns cleanly with AV:L/PR:L. Priority is driven by the enormous install base rather than remote reachability - this is not internet-exposed, so it is a defense-in-depth / post-foothold concern, not an emergency perimeter patch.

A local attacker who already has an unprivileged account or code execution (e.g., a standard user, a sandboxed process, or malware needing to escalate) invokes an affected NVIDIA kernel-mode driver interface with crafted parameters that trigger an integer overflow, causing an out-of-bounds write into kernel memory. By shaping the overflow, the attacker corrupts kernel structures to gain code execution at kernel/SYSTEM privilege, escalating from the initial low-privilege context. No public exploit code was identified at time of analysis, and exploitation requires no user interaction once local access is obtained.