NVIDIA Display Driver EUVD-2026-90157

Requires local access to a host running an affected NVIDIA GPU Display Driver (GeForce, RTX/Quadro/NVS, or Tesla branches below the fixed versions in bulletin 5861) AND the attacker must already hold HIGH privileges (PR:H) on that host to reach the kernel-mode driver interface. No user interaction is required (UI:N) and no special non-default driver configuration is called out - any affected driver version is exposed. Note for GeForce specifically, driver versions prior to 582.78 affect only GPUs based on NVIDIA Maxwell, Volta, and Pascal architectures. Limiting factors: no network vector (AV:L, cannot be triggered remotely), and the PR:H prerequisite means the attacker must already be highly privileged - this is a local privilege/kernel-escalation primitive, not an initial-access vector.

Real-world risk is MODERATE-LOW despite full-CIA impact. The CVSS 3.1 vector (6.7, AV:L/AC:L/PR:H/UI:N/S:U) is the dominant signal and it is decisively local: an attacker must already have HIGH privileges (PR:H - effectively administrator/root or equivalent kernel-adjacent access) on the host before touching this kernel-mode array-index flaw. No EPSS score, no CISA KEV listing, and no public POC were provided, so all exploitation-probability signals are absent. The 'RCE' tag conflicts with the CVSS vector: with AV:L this is local code execution in kernel mode, not remote exploitation - treat 'RCE' as loose labeling, not network-reachable RCE. The high PR requirement is the key mitigating factor; an attacker holding PR:H already controls most of the system, so the practical marginal gain is kernel-level code execution/privesc from an already-privileged position. No conflicting network-vs-local signals beyond the tag. Priority: medium at most for hosts where untrusted users can obtain high privileges; otherwise low.

An attacker who already holds high privileges on a Windows or Linux workstation or GPU compute node submits a crafted request through the NVIDIA kernel-mode driver interface that supplies an out-of-bounds array index. The driver fails to validate the index, corrupting kernel memory and yielding kernel-mode code execution, privilege escalation to full kernel control, or a system crash. No public exploit code was identified at time of analysis.