NVIDIA Display Driver EUVD-2026-90160

Requires local access to a system running the NVIDIA GPU Display Driver (Windows or Linux) with existing HIGH privileges (PR:H) to reach the vulnerable kernel-mode code path that improperly validates input; no user interaction is needed (UI:N). Limiting factors: exploitation is not remote (AV:L), the attacker must already hold high privileges before triggering the flaw, and only systems with the affected GeForce/RTX/Quadro/NVS/Tesla driver installed are exposed - this is a local escalation/kernel-compromise primitive, not an internet-facing exposure.

This is a moderate-priority local privilege-escalation-class flaw, not a remote emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U) is internally consistent with a kernel-mode driver bug: the attacker must already be on the host AND already hold high privileges (PR:H) to reach the vulnerable kernel-mode input-validation path, which caps the base score at 6.7 despite full C:H/I:H/A:H impact. The 'RCE' tag is misleading - with AV:L this is local code execution in kernel context, not network-exploitable remote code execution. No EPSS score, no CISA KEV listing, and no public POC are provided, so exploitation status is 'no public exploit identified at time of analysis'; the NVIDIA reference bundle (bulletin 5861) is a patch/advisory, not a weaponization signal. The PR:H requirement is the dominant real-risk limiter: an attacker who already has high privileges gains limited marginal value from a further local escalation, though kernel code execution can still be used to defeat driver/OS integrity boundaries. Net: a legitimate patch-management item across NVIDIA GPU fleets, but not a drop-everything issue absent any exploitation evidence.

A local attacker who has already obtained high privileges on a Windows or Linux workstation or GPU compute node submits malformed input to the NVIDIA GPU Display Driver's kernel-mode layer, exploiting improper input validation (CWE-20) to corrupt kernel state. The result can be arbitrary code execution in kernel context, a driver/system crash (DoS), or disclosure/tampering of kernel memory. No public exploit code is identified at time of analysis, and no user interaction is required.