NVIDIA Display Driver EUVD-2026-90132

Requires the attacker to already have unprivileged local code execution on a host running the NVIDIA GPU Display Driver (Windows or Linux) with a GeForce, RTX/Quadro/NVS, or Tesla GPU present and the driver loaded. Exploitation is performed by issuing a specific sequence of driver commands (ioctl/escape-style calls) to the GPU device, so access to the driver device interface is needed. LIMITING FACTORS: no remote/network vector (AV:L) - cannot be triggered across the network; the attacker must first obtain a local low-privilege foothold (PR:L); the machine must have an NVIDIA GPU with the vulnerable driver branch installed and unpatched. No special non-default configuration or user interaction is required (UI:N), which makes it broadly applicable to any deployment meeting the GPU/driver precondition, including multi-tenant vGPU/VDI/cloud-GPU environments.

This is a genuine but LOCAL privilege-escalation risk, not a remotely-exploitable one. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 HIGH) confirms an attacker must already have low-privileged code execution on the host; there is no network attack surface despite the 'RCE' tag. Attack complexity is low (AC:L) and no user interaction is needed, so once an unprivileged foothold exists, triggering the use-after-free via a crafted driver-command sequence is reliable, and full C/I/A:H impact (kernel-mode code execution) makes this a strong local EoP primitive. No EPSS score, CISA KEV listing, POC, or SSVC decision data is provided, so there is no evidence of active exploitation or public exploit code - no public exploit identified at time of analysis. The practical priority driver is the enormous install base (consumer GeForce plus datacenter RTX/Quadro/Tesla/vGPU), which makes it attractive for sandbox-escape and container/VDI-tenant-escape chains even though it is not internet-facing. CONFLICT TO NOTE: the 'RCE' and 'Microsoft' tags misrepresent this as remote/Microsoft-vendor; the vector is local (AV:L) and the vendor is NVIDIA.

An attacker who already has an unprivileged account or code execution on a Windows or Linux machine with an NVIDIA GPU (e.g., a low-privilege user, a sandboxed process, or a tenant on a shared vGPU/cloud-GPU host) issues a specific sequence of GPU driver commands to trigger a use-after-free in kernel-mode driver memory. By grooming the freed allocation, the attacker corrupts kernel state to execute code at kernel privilege, escalating from unprivileged user to SYSTEM/root. No POC or active exploitation is currently known for this CVE.