EUVD-2026-90179
GHSA-gp98-cqvp-q4m4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-priv local code execution
-
ExploitCall vulnerable kernel-module interface with crafted input
-
ExecutionTrigger NULL pointer dereference in kernel
-
ImpactCrash driver/system (denial of service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local access with the ability to execute at least low-privileged code on a Windows system running the NVIDIA GPU Display Driver (kernel module loaded, i.e. an NVIDIA GPU present and driver installed - the default state on such machines). No user interaction and no network path exist (AV:L, UI:N). Exploitation is limited to a denial of service: it cannot yield code execution, privilege escalation, or data disclosure (C:N/I:N). The practical ceiling is crashing the driver or host, so realistic risk is confined to availability on multi-user, VDI, or cloud-GPU hosts where an unprivileged tenant could disrupt the machine. |
| Impact | This is a genuinely low-to-moderate priority issue despite affecting ubiquitous hardware. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) is internally consistent with the description: local access, low privileges, and an availability-only impact (C:N/I:N/A:H) matching a CWE-476 NULL pointer dereference that crashes the kernel driver. There is NO confidentiality or integrity impact and NO code execution - the worst realistic outcome is a driver/system crash (bugcheck/BSOD). No EPSS score, KEV listing, or POC was provided, so exploitation status is 'no public exploit identified at time of analysis.' There are no conflicting signals here: every source (NVIDIA advisory, NVD, CVSS) aligns on a local, low-privilege DoS. The only metadata discrepancy is a spurious 'Microsoft' vendor tag on what is an NVIDIA product, and an absent 'windows' platform tag. Compared to the RCE/privilege-escalation siblings in the same NVIDIA bulletin 5861, this DoS-only flaw is the least severe class and should be patched on a normal cadence rather than as an emergency. |
| Exploit ScenarioDerived | A local attacker who already has the ability to run low-privileged code on a Windows host (or an unprivileged user on a shared/VDI/cloud-GPU workstation) issues a crafted IOCTL or API call to the NVIDIA kernel-mode display driver that triggers an unchecked NULL pointer dereference. The dereference faults in kernel context, crashing the driver and typically bugchecking the machine, producing a denial of service. No public exploit code was identified, and the flaw yields only a crash - not code execution or data disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
A NULL pointer dereference in the kernel-mode component of the NVIDIA GPU Display Driver for Windows allows a local attacker who can already execute low-privileged code on the host to crash the graphics kernel driver, taking down the display stack or bugchecking the whole machine. The flaw is confined to availability: per the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, there is no network path, no user interaction, and no confidentiality or integrity impact, so it cannot be used for code execution, privilege escalation, or data disclosure. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS/KEV signals are absent; the practical risk is concentrated on multi-user, VDI, or cloud-GPU Windows hosts where an unprivileged tenant could repeatedly disrupt the machine, making this a genuinely low-to-moderate priority issue despite the ubiquity of the affected hardware.
RemediationAI
Apply the NVIDIA driver release identified in the vendor's advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5861 (cross-referenced from https://nvd.nist.gov/vuln/detail/CVE-2026-47584 and https://www.cve.org/CVERecord?id=CVE-2026-47584); patch status is 'Patch available per vendor advisory' - the exact fixed driver version is not enumerated in the supplied data, so administrators must read the branch/version table in that advisory rather than assume a version number. Because the prerequisite is local low-privileged code execution, the highest-value compensating controls are reducing who can run code on the host at all: on VDI, terminal-server, and cloud-GPU Windows instances, restrict interactive logon and workload submission to trusted users, and avoid running untrusted or multi-tenant workloads on the same physical GPU host, accepting the trade-off that this reduces tenant density and flexibility. Where GPU isolation is mandatory, prefer scheduling untrusted tenants onto separate hosts or GPU partitions (MIG/vGPU-isolated instances) so a driver crash cannot affect other tenants, at the cost of higher infrastructure spend and lower utilization. Standard hardening such as least privilege, application allow-listing, and blocking untrusted executables lowers the chance an attacker obtains the low-privileged foothold the exploit requires, but does not fix the defect and can break legitimate line-of-business software if over-applied. Monitor Windows event logs for display driver timeouts and bugchecks (Event ID 4101 TDR events, BugCheck 0x50/0xD1 with the NVIDIA kernel module named) as a detection signal, noting that this only surfaces the symptom after availability is already lost. Disabling or removing the GPU/driver eliminates exposure but is impractical on any host that requires graphics or GPU compute; merely rebooting clears the crash state without addressing the root cause.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-476 NULL pointer dereference inside the NVIDIA Windows display driver's kernel module (the driver that backs the GPU in the Windows graphics stack, loaded as soon as an NVIDIA GPU is present and driver installed). Because the faulting code runs in kernel mode, dereferencing a NULL pointer that the driver failed to validate typically raises an access violation in ring 0, which Windows surfaces either as a display-driver recovery (TDR) event or as a full system bugcheck (classically 0x50 PAGE_FAULT_IN_NONPAGED_AREA or 0xD1 DRIVER_IRQL_NOT_LESS_OR_EQUAL). The CPE inventory shows the issue spans essentially the entire consumer and professional NVIDIA Windows driver surface - GeForce, RTX/Quadro/NVS, and Tesla (data-center/cloud-GPU) families - which is consistent with a defect in shared kernel-module code rather than a product-specific feature. The accessible attack surface is the driver's kernel-mode IOCTL/escape interface, which on Windows is reachable by any user permitted to open the GPU device object, hence the PR:L rating and the 'local access with at least low-privileged code execution' precondition in the assessment; the low AC and missing UI components mean no privilege hurdle beyond that and no victim action is required once the attacker has a foothold. The assessment is explicit that the impact ceiling is denial of service only - the dereference is not described as attacker-controlled or reachable to a controllable write, so exploitation does not yield memory corruption primitives.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local low-privileged trigger (AV:L/PR:L) with no interaction; NULL deref yields only a kernel crash, so A:H with C:N/I:N and no scope change.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
DescriptionCVE.org
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker with local access could cause a NULL pointer dereference. A successful exploit of this vulnerability might lead to denial of service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB