NVIDIA vGPU EUVD-2026-90185

Requires an NVIDIA vGPU deployment (Virtual GPU Manager on a hypervisor host serving guest VMs) on Windows or Linux, and local low-privileged code execution inside a guest VM that can reach the GPU kernel driver. The limiting factors are significant: no network vector (AV:L), so the attacker must already have a foothold as a guest tenant; exploitation is only meaningful in virtualized/multi-tenant vGPU configurations, not on standalone GPU driver installs. No user interaction is needed (UI:N), and only low guest privileges are required (PR:L), making it a realistic escalation primitive for any authenticated guest user in shared-GPU/VDI/cloud environments.

This is a genuine but operator-context-dependent priority rather than an internet-facing emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) shows a LOCAL attack vector with LOW privileges required and no user interaction, mapping to CWE-862 (Missing Authorization) where a guest VM accesses privileged host GPU resources. The real-world significance is that in a vGPU/VDI/cloud-GPU deployment the 'local low-privileged' attacker is a tenant inside a guest VM, so this is effectively a guest-to-host isolation breach - the type of boundary crossing that matters greatly in multi-tenant environments even though it is not remotely reachable. No EPSS score, KEV listing, or public POC is provided, so there is no evidence of active or imminent widespread exploitation; the 'RCE' tag overstates reach since the vector is strictly local (AV:L), not network. Signals are consistent (vendor CVSS, description, and CWE all align on a local authorization failure); the main caveat is that the scope is marked S:U despite the guest-to-host framing, so defenders should treat the cross-boundary impact as the operative risk regardless of the unchanged-scope rating.

A low-privileged user operating inside a guest VM on an NVIDIA vGPU-enabled hypervisor issues crafted requests to the GPU kernel driver that reach privileged host GPU resources the guest is not authorized to touch. Because authorization is not properly enforced, the guest gains access that can lead to code execution, privilege escalation, data tampering, or information disclosure on the host. No public exploit code is identified at time of analysis, and exploitation requires local guest access rather than any network reachability.