NVIDIA’s Virtual GPU Manager contains a use‑after‑free vulnerability that can be triggered by an attacker, allowing an untrusted entity to read or write arbitrary stack memory. The flaw is classified as CWE-416 and could be abused to cause denial of service, elevate privileges, leak confidential information, tamper with data, or execute arbitrary code from the context of the manager. All of these consequences stem from improper deallocation of stack resources.

The vulnerability affects NVIDIA’s Virtual GPU Manager; specific product versions were not disclosed. Systems that host virtual GPUs via NVIDIA’s software are potentially impacted.

The CVSS score of 7.0 reflects a moderate‑to‑high risk. With no EPSS data and absence from CISA’s KEV catalog, the likelihood of exploitation is uncertain but a local or privileged attacker could likely drain the stack and trigger the fault. The attack vector is inferred to be a local or host‑side compromise that targets the virtual GPU manager’s memory handling routines. Organizations running NVIDIA vGPU software should treat this as a serious risk until a patch is applied.