EUVD-2026-90127
GHSA-6g3p-p638-wwf2
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a genuine but access-gated local privilege-escalation risk, not a remote mass-exploitation threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U, C:H/I:H/A:H, base 7.8 HIGH) confirms the attacker must already be a low-privileged local user on the Windows host; there is no network vector despite the 'RCE' tag, which is misleading here (code execution occurs locally in the kernel module, not over the network). No EPSS score, CISA KEV listing, or public POC is provided in the input, so there is no evidence of active exploitation - treat exploitation status as 'no public exploit identified at time of analysis.' The CWE-843 type-confusion primitive in a kernel module is a high-value bug class because successful triggering yields SYSTEM-level code execution from a normal user, so where NVIDIA display drivers are broadly deployed this warrants timely patching; however, the local-only prerequisite and absence of exploitation signals place it below internet-facing criticals in real-world priority. The signals are internally consistent (kernel local EoP, full CIA impact, unchanged scope); the only conflict is the metadata, not the severity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Type confusion in the kernel-mode component of the NVIDIA GPU Display Driver for Windows allows a local attacker who already holds low-privileged code execution to corrupt kernel memory and potentially escalate to SYSTEM, crash the machine (BSOD/DoS), disclose kernel memory, or tamper with data. The issue is rated CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must be local and authenticated with low privileges and no user interaction is required, and it affects the GeForce, RTX/Quadro/NVS and Tesla Windows driver branches. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is an access-gated local privilege-escalation risk rather than a remotely reachable mass-exploitation threat.
RemediationAI
Apply the updated NVIDIA Windows GPU Display Driver specified in NVIDIA's advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5861 (NVIDIA product-security repository, 2026 entry 5861); that bulletin is the authoritative source for the exact patched driver version on each branch (GeForce/Studio, RTX/Quadro/NVS, Tesla), so verify the listed fixed version against the driver actually installed instead of assuming a single generic “latest” download covers every branch. Because exploitation requires local low-privileged code execution (AV:L / PR:L / UI:N), interim compensating controls are to reduce the number of non-administrative local accounts and processes that can run code on GPU-equipped Windows hosts, restrict and monitor third-party GPU/CUDA/DirectX user-mode components that pass untrusted buffers into the driver, keep user-mode and kernel-mode driver components at matching versions (mismatched pairs are a common way type-confusion paths are reached), and enable Windows kernel crash and telemetry logging so exploitation attempts that surface as bugchecks are detected. These controls only raise the cost of exploitation; they do not remove the kernel type-confusion primitive, and any local unprivileged process remains a viable delivery path until the driver is updated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a type confusion (CWE-843) inside the kernel module of NVIDIA's Windows display driver, the ring-0 component that the user-mode driver and the Windows graphics stack reach through IOCTL/escape interfaces. Type confusion arises when kernel code operates on a buffer using the layout of a different object type than the one actually allocated; if attacker-influenced data reaches that path it can be reinterpreted as pointers, lengths or function/vtable entries, yielding out-of-bounds reads and writes, corrupted kernel structures and, depending on the allocation and primitives reachable, arbitrary kernel memory access. Because this executes in kernel mode, a successful exploit can produce privilege escalation to SYSTEM, code execution in a privileged context, denial of service via bugcheck/BSOD, disclosure of kernel memory contents, and tampering with data. The CVSS vector (AV:L, AC:L, PR:L, UI:N, S:U, C:H/I:H/A:H) confirms the prerequisite is local code execution with low privileges and no user interaction, with impact confined to the same security authority (no scope change). The supplied CPE data maps the issue to nvidia:geforce, nvidia:rtx,_quadro,_nvs and nvidia:tesla on the Windows driver, with wildcard version fields indicating multiple affected driver branches rather than one pinned release.
Know when Geforce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
DescriptionCVE.org
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause type confusion. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Articles & Coverage 2
Executive ViewAI
High-severity type confusion in NVIDIA's Windows GPU display drivers (GeForce, RTX/Quadro/NVS, Tesla branches) allows an authenticated local attacker with low privileges to escalate to SYSTEM, corrupt kernel memory, or cause system crashes on affected endpoints. While no public exploit identified at time of analysis, a successful attack could lead to full control of the machine, sensitive data exposure, or operational disruption. Leadership should act because no vendor-released patch identified at time of analysis, leaving organizations dependent on interim controls to mitigate this local privilege-escalation risk.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce strict least-privilege access to limit local code execution, monitor for anomalous kernel memory access patterns, and apply application whitelisting to block unauthorized binaries. Consider isolating high-value systems until a patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Local privilege escalation and code execution in the NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, an
An out-of-bounds read in the kernel-mode layer of NVIDIA GPU Display Driver on Windows and Linux allows a local, authent
An out-of-bounds write in NVIDIA NVAPI for Windows allows a locally authenticated attacker holding standard user privile
Type confusion in the kernel-mode layer of the NVIDIA GPU Display Driver for Linux allows a local low-privileged user (C
Local privilege escalation in NVIDIA GPU Display Driver for Windows (CUDA driver component) allows an authenticated atta
Local privilege escalation in NVIDIA Display Driver for Windows allows an authenticated low-privileged user to trigger a
Local privilege escalation and potential code execution in NVIDIA GPU Display Driver for Windows and Linux arise from a
Local privilege escalation in NVIDIA Display Driver for Windows and Linux allows an unprivileged local attacker to trigg
Local privilege escalation and memory corruption in NVIDIA GPU Display Driver on Windows and Linux, affecting GeForce, R
Local privilege escalation in the NVIDIA GPU Display Driver for Linux allows an authenticated, unprivileged user to trig
Local privilege escalation in the kernel-mode layer of the NVIDIA GPU Display Driver for Linux allows an unprivileged lo
Privilege escalation in NVIDIA's GPU Display Driver for Windows lets a local, low-privileged authenticated user bypass a
Exploit-DB