The vulnerability in NVIDIA Virtual GPU Manager lies in the GPU System Processor (GSP) plugin where a guest virtual machine can send a crafted RPC message that triggers an out‑of‑bounds write. This flaw can lead to code execution, privilege escalation, data tampering, denial of service, and information disclosure if successfully exploited.

The affected product is NVIDIA Virtual GPU Manager. All versions of the manager are listed by the CNA as vulnerable, but no specific version range is provided. The issue originates in the GSP plugin used by NVIDIA’s virtual GPU infrastructure.

The CVSS score of 7.8 marks it as high severity. EPSS data is not available, so the exploit probability could not be quantified, and the vulnerability is not in the CISA KEV catalog. The likely attack vector is from a guest VM user who can inject the malicious RPC; therefore, access control to the hypervisor’s RPC interface is critical. The potential impact includes local privilege escalation to the host or other virtual machines, matching the impact described in the official report.