NVIDIA Display Driver EUVD-2026-90123

Requires local access with the ability to run unprivileged code on a Windows host that has the affected NVIDIA GPU Display Driver installed (GeForce, RTX/Quadro/NVS, or Tesla), and the ability to reach the display driver's DIAG escape handler via a device I/O call. No network vector, no authentication beyond an ordinary local user session, and no user interaction are needed (PR:L, UI:N). Limiting factors: exploitation is confined to the local machine (AV:L), so an attacker needs a prior foothold; successful code execution also requires reliable kernel pool grooming after the integer overflow, and the impact is materially higher on shared systems (multi-user workstations, VDI, cloud GPU instances) where untrusted low-privileged users legitimately have local access.

All signals point to a genuine but locally-scoped privilege/stability risk rather than a remotely-wormable threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) confirms the attacker must already have local, low-privileged code execution on the host - this is a kernel-mode escape handler bug reachable from an unprivileged user context, not a network-facing flaw. The 'RCE' tag is therefore misleading: code execution here means local escalation to kernel/driver privilege, not remote code execution across the network. No EPSS score, no CISA KEV listing, and no public POC are provided, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data supplied. The realistic priority is MEDIUM: the impact ceiling is high (kernel OOB write from integer overflow can yield full C:H/I:H/A:H), the product footprint is enormous, and NVIDIA has published a fix - but the local-only precondition and absence of any exploitation evidence keep this out of emergency-patch territory for most single-user endpoints, while multi-user, VDI, and cloud-GPU hosts should prioritize it higher because low-priv local access is more plausible there.

A local unprivileged user (or malware already running in a low-integrity context) opens the NVIDIA display driver device and issues a crafted DIAG escape call with a size/count field engineered to trigger an integer overflow, causing an undersized allocation followed by an out-of-bounds write in kernel memory. By grooming kernel pool layout, the attacker corrupts adjacent structures to hijack control flow and execute code at driver/kernel privilege, escalating from standard user to SYSTEM; a failed attempt instead bugchecks the machine (denial of service). No public POC is currently available.