NVIDIA Display Driver EUVD-2026-90146

Requires local access to a Windows system running the affected NVIDIA GPU Display Driver (GeForce, RTX/Quadro/NVS, or Tesla, including Guest Driver / vGPU Manager deployments) plus an already-authenticated low-privileged account (PR:L) able to communicate with the kernel module. Exploitation is limited by high attack complexity (AC:H) - the OOB write depends on a hard-to-control condition such as a race or precise memory state - so it is not reliably one-shot. No user interaction is needed (UI:N) and no non-default feature toggle is documented, but the local + low-privilege + AC:H combination substantially narrows realistic risk versus a network-reachable bug. Multi-user, VDI, and cloud/virtual-GPU hosts where untrusted users share a GPU-equipped machine are the primary risk environments.

This is a locally-exploitable kernel-mode memory-corruption flaw in the NVIDIA GPU Display Driver for Windows, not a remotely-reachable one. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) indicates an already-authenticated low-privileged local user (PR:L) must win a difficult condition (AC:H, e.g. a race or precise memory-state precondition), which is why this scores 7.0 rather than the 7.8 of the AC:L siblings in the same bulletin. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis' - the impact ceiling (full C:H/I:H/A:H via kernel code execution) is high, but real-world exploitation likelihood is currently unproven and constrained by both the local-access requirement and the high attack complexity. The 'RCE' tag conflicts with the CVSS vector: AV:L means this is local privilege escalation / kernel compromise, not remote code execution. Net: a genuine local-privesc concern for multi-tenant, VDI, and cloud-GPU hosts, but not an emergency internet-facing threat; patch on a normal prioritized cycle.

A low-privileged local user (or a sandboxed/compromised process) on a Windows host with an NVIDIA GPU issues crafted requests to the vulnerable kernel driver, and by winning a timing/state-dependent condition (AC:H) triggers an out-of-bounds write in kernel memory. Successful corruption of kernel structures yields SYSTEM-level code execution, privilege escalation, or a bugcheck/DoS. No public exploit code is identified at time of analysis, and no user interaction is required (UI:N).