NVIDIA Virtual GPU Manager contains a flaw in the GPU System Processor tracing component whereby a guest virtual machine can send crafted data through a shared buffer, causing improper access. This vulnerability can lead to code execution, privilege escalation, data tampering, denial of service, and information disclosure. The weakness corresponds to a race condition (CWE-367).

All deployments of NVIDIA Virtual GPU Manager are affected. No specific version range is provided, so all releases prior to the vendor’s fix are considered vulnerable.

The CVSS score of 7.8 indicates high severity. EPSS is not available, and the vulnerability is not listed in KEV, suggesting lower public exploitation but still significant risk. A guest VM with arbitrary data injection could exploit the race condition in the tracing path, potentially gaining code execution on the host or interfering with other VMs. Attackers would need access to the guest environment; the attack vector involves manipulating the shared buffer used for tracing.