NVIDIA Display Driver EUVD-2026-90134

Requires local code execution as an already-authenticated, unprivileged user on a host running the affected NVIDIA GPU Display Driver (GeForce, RTX/Quadro/NVS, or Tesla) on Windows or Linux, including Guest Driver and vGPU Manager deployments. The attacker must be able to interact directly with the kernel-mode driver interface (device/ioctl) to send the crafted command that triggers the out-of-bounds read - there is no network vector and no user-interaction requirement. Limiting factors: exploitation is impossible remotely (AV:L), needs a foothold account (PR:L), and highest-value impact arises in multi-user/shared-GPU contexts (VDI, cloud GPU, virtualization via Guest Driver/vGPU Manager); single-user workstations face mainly local DoS/info-leak risk. Patched driver branches are available in NVIDIA security bulletin 5861.

This is a genuine but locally-scoped privilege/stability risk rather than a remotely-wormable emergency. The vendor CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 HIGH) is internally consistent with the description: exploitation requires local access (AV:L) and an existing low-privileged account (PR:L), which sharply limits the attacker population compared to a network-facing flaw. No EPSS score, CISA KEV entry, or public POC was provided, so exploitation status is 'no public exploit identified at time of analysis' - there is no evidence of active exploitation or automation. A notable tension exists between the root cause and the claimed impact: CWE-125 is an out-of-bounds READ, which most naturally yields information disclosure and denial of service, yet NVIDIA lists the full impact set including code execution, privilege escalation and data tampering (justifying C:H/I:H/A:H). This breadth is typical of NVIDIA's conservative kernel-driver advisories and should be treated as a vendor-asserted worst case, not independently confirmed exploit primitives. The 'RCE' tag overstates reachability because the CVSS vector is AV:L (local), not network. Net: real priority for multi-tenant, VDI and cloud-GPU environments where untrusted users share a GPU host, but a lower priority on single-user workstations.

A low-privileged local user on a shared workstation, VDI session, or cloud-GPU instance issues crafted ioctl/driver commands to the NVIDIA kernel-mode layer, triggering an out-of-bounds read. In the benign case this leaks adjacent kernel memory (info disclosure) or crashes the driver (DoS); the vendor further warns the condition may be leveraged toward code execution and privilege escalation in the kernel. No public exploit code is known at time of analysis.