NVIDIA GPU Display Driver EUVD-2026-90153

Requires local access to a system running a vulnerable NVIDIA GPU Display Driver (GeForce, RTX/Quadro/NVS, or Tesla branches below the fixed versions listed in EUVD-2026-90153) AND high existing privileges (PR:H) to reach the kernel-mode layer and submit the malformed GPU command that carries the out-of-range array index. No user interaction is needed (UI:N) and no network path exists (AV:L). Exploitation is limited by the PR:H prerequisite - the attacker must already be a privileged local user - and by the need for a specific unpatched driver branch; there is no remote or unauthenticated vector.

Genuine but moderate priority. The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (6.7, MEDIUM) is internally consistent with the description: this is a local kernel-mode flaw requiring high privileges (PR:H), not a remotely reachable RCE. The 'RCE' tag overstates real reach - with AV:L there is no network vector; an attacker must already have code execution on the host, and per PR:H typically elevated/administrative access, before triggering the array-index flaw. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active exploitation or automatable mass exploitation - this is a defense-in-depth kernel patch, not an emergency. The realistic value to an attacker is escalation/persistence within an already-compromised system or bypassing a sandbox/VM boundary, or crashing the host (DoS). The PR:H requirement is the single largest limiting factor and should temper any alarm raised by the multi-impact description (code exec + privesc + info disclosure + tampering).

A local attacker who already holds high privileges on a Windows or Linux host with a vulnerable NVIDIA GPU driver crafts a malicious ioctl/GPU command with an out-of-range array index, triggering improper index validation in the kernel-mode layer. The resulting out-of-bounds access corrupts kernel memory to escalate privileges, disclose kernel data, or crash the system. No public exploit code was identified at time of analysis, and exploitation is local-only.