NVIDIA Display Driver EUVD-2026-90144

Requires local access to a Windows system running the NVIDIA GPU Display Driver (GeForce, RTX/Quadro/NVS, or Tesla lines) - the attacker must be able to execute code and issue requests to the NVIDIA kernel module, i.e. have an interactive or programmatic local session. Per the CVSS vector no elevated privileges (PR:N) and no user interaction (UI:N) are needed to reach the vulnerable kernel path. LIMITING FACTORS: not remotely exploitable (AV:L), so an external attacker must first obtain local execution; impact is confined to kernel memory disclosure and driver/system crash with no memory corruption or privilege escalation; only Windows deployments of the affected driver are in scope.

This is a moderate-severity local vulnerability, not a remote or internet-facing threat despite the 7.7 CVSS. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H confirms local attack vector (AV:L) with low complexity and no user interaction, meaning an attacker must already have code execution on the host. Notably NVIDIA assigned PR:N (no privileges) here, which is more permissive than most sibling bulletin-5861 CVEs that use PR:L - this implies any local user, even unprivileged, can reach the vulnerable kernel ioctl path, though a logged-in local session is still required. Impact is limited to confidentiality (C:H, kernel memory disclosure) and availability (A:H, driver/system crash); there is NO integrity impact (I:N) and no code-execution/privilege-escalation claim, because an out-of-bounds READ (CWE-125) cannot corrupt memory. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or automated weaponization. Real priority is MEDIUM: broadly deployed product and low attack complexity, but gated behind local access and yielding only info-disclosure/DoS rather than full compromise. No key signals conflict, though note the 'Buffer Overflow' tag is imprecise for a read-only OOB condition.

A local user (or malware already running at low/normal privilege) on a Windows workstation or GPU compute host issues a crafted request to the NVIDIA kernel driver, triggering an out-of-bounds read in the kernel module. The attacker either harvests disclosed kernel memory contents (potentially leaking addresses or sensitive data useful for defeating KASLR or chaining further attacks) or crashes the display driver/system for denial of service. No public exploit code is identified at time of analysis.