NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a kernel‑mode vulnerability that allows a guest VM to read memory beyond its allocated bounds. This out‑of‑bounds read can be leveraged by an attacker to gain sensitive information or to pivot to more damaging actions. A successful exploitation may lead to code execution on the host, denial of service, privilege escalation, information disclosure, and data tampering.

The affected product is NVIDIA Virtual GPU Manager used to provide GPU virtualization to guest operating systems. The vulnerability applies to both Windows and Linux host installations that deploy the vGPU Manager. The specific affected release versions are not enumerated in the advisory, so all current releases of vGPU Manager should be considered potentially vulnerable until a patch is released.

The CVSS base score of 7.8 reflects a high severity, while EPSS data is unavailable and the vulnerability is not listed in CISA KEV. The attack vector requires the attacker to control or influence a guest VM that interacts with the vGPU Manager kernel component; from that position the guest could trigger the out‑of‑bounds read. Because the flaw resides in kernel code, exploitation may grant local privilege escalation to the host or allow the guest to crash the host, resulting in denial of service or potential data tampering.