NVIDIA Display Driver EUVD-2026-90154

Requires local access to a system running an affected NVIDIA GPU Display Driver (GeForce, RTX/Quadro/NVS, or Tesla) on Windows or Linux, with the attacker already holding HIGH privileges (PR:H) sufficient to invoke the vulnerable firmware code path - no remote vector and no user interaction. The flaw is in the GPU firmware layer reached via the driver. Note the GeForce 582.78 branch is limited to GPUs on NVIDIA Maxwell, Volta, and Pascal architectures per the EUVD version notes; other listed branches are not architecture-restricted. Limiting factors that reduce real-world risk: local-only reach, the pre-existing high-privilege requirement, and that an out-of-bounds read most often produces a crash or memory disclosure rather than dependable code execution.

This is a genuine-but-moderate-priority local vulnerability, not a high-CVSS remote emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 6.7 Medium) is internally consistent with the description: local attack vector, low complexity, but requiring HIGH privileges (PR:H) on the host before the flaw can be reached. The 'RCE' tag overstates reach - with AV:L there is no network attack surface, so any code execution is local-only and gated behind existing high privilege. No EPSS score, CISA KEV entry, or public POC is present in the supplied data, and no SSVC decision block was provided; per precision rules this is 'no public exploit identified at time of analysis.' Practical exploitation value is low because an attacker who already holds PR:H on the machine has limited additional to gain, and CWE-125 (out-of-bounds READ) more realistically yields a crash (DoS) or information disclosure than reliable arbitrary code execution, despite the vendor listing the full impact spectrum. Net: real and worth patching in managed fleets, but not a drop-everything issue given local-only access and the high-privilege precondition.

An attacker who has already obtained high-privileged access on a workstation or GPU compute node (e.g., an administrator account or a privileged service context) invokes the vulnerable GPU firmware interface with crafted parameters, triggering an out-of-bounds read. This most plausibly leaks adjacent kernel/firmware memory or crashes the GPU driver stack (DoS); code execution is claimed by the vendor but is harder to achieve from an OOB read. No public exploit code is known at time of analysis.