NVIDIA GPU Display Driver for Windows and Linux contains an out‑of‑bounds write vulnerability in its kernel‑mode layer. The flaw, classified as CWE‑787, can enable a user to write beyond an allocated buffer, potentially leading to code execution, privilege escalation, denial of service, information disclosure, or data tampering. The Vulnerability’s CVSS score of 6.7 indicates moderate severity with a range of possible impacts.

Affected products include NVIDIA GeForce, RTX, Quadro, NVS, and Tesla GPUs, as well as the NVIDIA Guest driver. The vulnerability applies to the Windows and Linux operating systems that use the GPU Display Driver.

The CVSS metric of 6.7 suggests a moderate risk, and no EPSS score is available, implying limited publicly observed exploitation activity at this time. It is not currently listed in CISA’s KEV catalog. The attack vector can be inferred to require local user privileges to load or interact with the driver in order to trigger the out‑of‑bounds write. If an attacker can craft a payload that causes the kernel‑mode layer to overwrite memory, they can potentially gain elevated privileges and execute arbitrary code on the system.