NVIDIA Display Driver EUVD-2026-90171

Requires local access with a low-privileged account (PR:L) on a Windows or Linux system running a vulnerable NVIDIA GPU Display Driver (GeForce, RTX/Quadro/NVS, Tesla) or Virtual GPU Manager build below the fixed versions in bulletin 5861. The attacker must be able to invoke the kernel-mode driver interface (available to normal users via the standard GPU device/user-mode driver path) and supply input that drives a division-by-zero. Limiting factors: no remote vector (AV:L), no code execution or data exposure possible (impact is DoS only), and the fix is available - patched driver branches such as GeForce 616.56, RTX/Quadro/NVS 596.86, and Tesla 616.92 remediate it. Note one advisory line restricts a specific GeForce branch to GPUs on Maxwell, Volta, and Pascal architectures.

This is a genuinely low-to-moderate priority issue whose CVSS 5.5 (MEDIUM) rating accurately reflects real-world risk - it is not an inflated score. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H is internally consistent and matches the description: a local, already-authenticated low-privilege user triggers a divide-by-zero (CWE-369) in the kernel-mode driver layer, causing only availability loss (A:H) with no confidentiality or integrity impact (C:N/I:N). No EPSS score, KEV listing, or POC was provided in the input, so exploitation probability signals are absent rather than low - this reflects no public exploit identified at time of analysis. There are no conflicting signals: the local attack vector, DoS-only impact, and low complexity all align. The key limiter is that this cannot be reached remotely and yields only a driver/system crash (likely a bugcheck/kernel panic), not privilege escalation or code execution, so it is a nuisance/availability concern rather than a breach vector. Note the 'Microsoft' tag is a vendor mislabel - this is an NVIDIA product on Windows and Linux.

A local low-privileged user (or malicious/compromised process) on a Windows or Linux machine with a vulnerable NVIDIA GPU driver issues a crafted call into the kernel-mode driver layer with parameters that produce a division by zero, crashing the driver and denying GPU/system availability. No public exploit code was identified in the provided data, and no user interaction or elevated privileges beyond a local account are required.