NVIDIA Display Driver EUVD-2026-90183

Requires local access to a Windows or Linux system running an affected NVIDIA GPU Display Driver (GeForce, RTX/Quadro/NVS, or Tesla branch; see EUVD version ranges such as prior to 615.71.09 / 610.57.04 / 580.178.04) with a physical NVIDIA GPU present. The attacker must already possess HIGH privileges (PR:H) to reach the vulnerable kernel-mode interface; no user interaction is needed. Exploitation is bounded to denial of service - no confidentiality or integrity impact is possible. The high-privilege prerequisite is the key limiting factor: an unprivileged user cannot trigger this.

All signals point to a LOW real-world priority despite the nominal MEDIUM CVSS. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H = 4.4) is internally consistent with the description: local attack vector, HIGH privileges required, and availability-only impact (C:N/I:N). Impact is strictly denial of service via a kernel-mode NULL pointer dereference - no code execution, privilege escalation, or information disclosure. Notably, PR:H sets this apart from sibling NULL-pointer-deref NVIDIA DoS issues that require only PR:L and therefore score 5.5; here the attacker must already hold high (typically administrative) privileges, sharply reducing the marginal threat since such a user can usually disrupt the system by other means. No EPSS score, no CISA KEV listing, and no public POC were provided - exploitation status is 'no public exploit identified at time of analysis.' No signals conflict. The only data-quality issue is a spurious 'Microsoft' vendor tag and an absent 'Windows' platform tag despite the product spanning Windows and Linux.

A local attacker who already holds high/administrative privileges on a Windows or Linux host running an affected NVIDIA GPU display driver issues a crafted request to the kernel-mode driver that triggers a NULL pointer dereference, crashing the driver or the system. No public exploit code is available, and the outcome is limited to denial of service with no data compromise.