NVIDIA GPU Driver EUVD-2026-90124

Exploitation requires local access with at least low-privilege code execution (PR:L) on a Windows host that has the NVIDIA GPU Display Driver installed (GeForce, RTX/Quadro/NVS, or Tesla product lines). The attacker interacts with the vulnerable kernel module - typically via a crafted user-to-kernel request (e.g., IOCTL) - to trigger the integer-overflow-driven incorrect comparison; no user interaction (UI:N) and no non-default configuration are required beyond having the driver present, which is the normal state on any NVIDIA-GPU-equipped Windows system. Limiting factors: the attack vector is local only (AV:L) - there is no network or remote path - so the flaw serves as a post-compromise escalation/DoS primitive rather than an initial-access vector, and the attacker must already be authenticated on the machine.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) makes clear this is a LOCAL, authenticated privilege-escalation class flaw, not a remotely reachable one: an attacker must already have code execution as a low-privileged user (PR:L) on the machine running the NVIDIA GPU Display Driver for Windows. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so all three exploitation-probability signals are absent - this is no public exploit identified at time of analysis. The high base score is driven entirely by the C:H/I:H/A:H triad typical of kernel-mode memory-safety bugs, where a single defect plausibly yields code execution, DoS, privilege escalation, information disclosure, and tampering; the vendor lists all of these as *possible* ('might lead to') outcomes rather than demonstrated ones. Realistically this is a meaningful but second-tier priority: kernel-mode LPE on ubiquitous GPU drivers is attractive as a post-compromise escalation primitive (sandbox escape, EDR evasion, full SYSTEM), but the local-only vector and low real-world exploitation signals mean it is patch-in-cycle rather than emergency. Note a data conflict: the description states the root cause is an 'incorrect comparison' (which maps to CWE-697), yet the assigned CWE is CWE-190 (Integer Overflow) and the tags say 'Integer Overflow' - the two are related (an overflowed value feeding a flawed bounds comparison) but the labeling is internally inconsistent; treat the precise root cause as unconfirmed pending NVIDIA bulletin 5861 detail.

A low-privileged user (or malicious code running in a restricted/sandboxed context) on a Windows workstation or GPU server with the NVIDIA display driver installed issues a crafted IOCTL/API call to the vulnerable kernel module, triggering an integer overflow that corrupts a bounds comparison. The resulting out-of-bounds kernel memory access is leveraged to escalate to SYSTEM or crash the machine. No public exploit code is identified at time of analysis, and exploitation requires prior local access.