NVIDIA Display Driver EUVD-2026-90159

Requires local access to a Windows or Linux host running an affected NVIDIA GPU Display Driver (GeForce, RTX/Quadro/NVS, or Tesla) AND high existing privileges (PR:H - effectively administrator/root or an equivalently privileged context able to reach the firmware interface). No user interaction is needed (UI:N) and no network path exists (AV:L). The primary limiting factors are the high-privilege prerequisite, which confines exploitation to attackers who already control the host at an elevated level, and the local-only attack surface, which rules out remote exploitation entirely.

Real-world risk is moderate, not urgent. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U, base 6.7) is the dominant signal and it is internally consistent: exploitation is local-only and requires HIGH privileges, so this is a privilege-bounded firmware flaw, not a remotely reachable one. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active or imminent exploitation. The 'RCE' tag overstates reachability - with AV:L there is no network vector, so any code execution is strictly local. The PR:H requirement is the key mitigating factor: an attacker must already hold high privileges (effectively administrator/root on the host) to reach the vulnerable firmware path, which dramatically shrinks the realistic attacker population and caps this as a local escalation/tamper issue rather than a mass-exploitable one. High CIA impact (C:H/I:H/A:H) keeps severity meaningful where the precondition is met. Net: a genuine but lower-priority patch item - high product footprint, low exploitation likelihood, high privilege barrier.

A local attacker who already possesses high privileges on a Windows or Linux host with an affected NVIDIA GPU driver crafts input that reaches the vulnerable firmware code path, triggering an out-of-bounds write. The memory corruption is then leveraged to execute code in a firmware/kernel context, escalate beyond the current privilege boundary, tamper with data, or crash the device. No public exploit code is identified at time of analysis, and no network vector exists.