NVIDIA GPU Display Driver EUVD-2026-90150

Requires local access to a system running an affected NVIDIA GPU Display Driver (GeForce, RTX/Quadro/NVS, or Tesla) or vGPU guest driver on Windows or Linux, AND the attacker must already hold high privileges (PR:H) to reach the vulnerable kernel-mode code path that performs the unbounded string operation. No user interaction is needed (UI:N) and no special non-default configuration is required - the vulnerable kernel-mode layer is part of the standard driver. Limiting factors: exploitation is strictly local (no network vector), gated behind high privileges, and constrained to the driver-version ranges below the fixed builds listed in EUVD (e.g., GeForce < 616.56/615.71.09, RTX/Quadro/NVS < 610.88, Tesla < 616.92, and corresponding vGPU guest driver builds).

Real-world risk is MODERATE and localized. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 6.7) is internally consistent with the description: exploitation requires local access to a machine running the affected NVIDIA kernel-mode driver AND already-held high privileges (PR:H), which substantially limits the realistic attacker population - an actor with PR:H on a GPU host typically already commands significant capability. There is no EPSS score, no CISA KEV listing, and no public POC provided, so exploitation status is: no public exploit identified at time of analysis. The 'RCE' tag overstates the vector: with AV:L this is local kernel-mode code execution / privilege escalation, not remote code execution - treat network-exploitability claims as unsupported. The full C:H/I:H/A:H triad is NVIDIA's standard worst-case rollup for a kernel-mode OOB read (CWE-125) that can lead to downstream code execution; note that a raw out-of-bounds READ most directly yields information disclosure and DoS, and the integrity/code-execution outcomes are the vendor's stated maximal potential rather than a demonstrated primitive. Net: this is a legitimate patch-worthy kernel driver bug but not an emergency - no signal of active or automatable mass exploitation.

A local attacker who already holds high privileges on a Windows or Linux system with a vulnerable NVIDIA GPU driver issues a crafted request to the kernel-mode layer that triggers an unbounded string operation, causing an out-of-bounds read. The leaked kernel memory or resulting corruption is then leveraged toward privilege escalation, information disclosure, or a driver/system crash (DoS). No public proof-of-concept is available, and exploitation requires local high-privilege access, not remote or unauthenticated entry.