NVIDIA Display Driver EUVD-2026-90163

Requires local access to a system running the NVIDIA GPU Display Driver (GeForce, RTX/Quadro/NVS, or Tesla) on Windows or Linux, AND the attacker must already possess HIGH privileges (PR:H) - administrator/root or equivalent - to reach the vulnerable firmware input-validation path; no user interaction is needed (UI:N). Limiting factors: the high-privilege prerequisite means an unprivileged user cannot trigger it directly, there is no remote/network vector (AV:L), and exploitation depends on presenting malformed input to the firmware interface. This is realistically a post-compromise escalation/persistence primitive rather than an initial-access vulnerability.

The vendor-supplied CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 6.7) describes a local vulnerability requiring HIGH privileges, which materially caps real-world risk despite the broad list of possible impacts (code execution, DoS, privesc, info disclosure, data tampering). PR:H means the attacker must already hold elevated/administrative privileges on the host before touching the GPU firmware input path, so this is a privilege-boundary/defense-in-depth issue rather than an entry-point vulnerability. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so exploitation status is: no public exploit identified at time of analysis. There is no SSVC data supplied. Signals are internally consistent (local, high-priv, firmware input validation) and point to a genuine but lower-tier issue: this is patch-in-normal-cycle territory, not an emergency. Note the 'RCE' tag overstates reachability - with AV:L this is local code execution, not network RCE. Because it is firmware-level (CWE-20 improper input validation), successful exploitation could persist below the OS, which is the main reason to prioritize it above a purely user-space local bug.

An attacker who has already obtained administrative/high-privilege access on a Windows or Linux workstation or Tesla-equipped server passes malformed input to the GPU display driver's firmware interface, which fails to validate it properly. This lets the attacker corrupt firmware-level state to escalate further, tamper with data, or crash the device (DoS). No public proof-of-concept exists, and the high-privilege prerequisite means it is realistically a second-stage/post-compromise action rather than an initial foothold.