An improper validation of an array index within the kernel mode layer of NVIDIA's GPU Display Driver can lead to code execution, denial of service, privilege escalation, data disclosure, and tampering. The vulnerability, identified as CWE-129 and CWE-1285, allows an attacker to corrupt memory via an out‑of‑ bounds write, potentially executing arbitrary machine code and compromising system integrity.

The vulnerability affects NVIDIA GPU Display Driver for both Windows and Linux on all NVIDIA GeForce, RTX, Quadro, NVS, and Tesla product lines. No specific driver revisions are listed in the advisory, so users should consult NVIDIA's product‑security releases for the relevant driver revisions. Both desktop and data‑center GPUs are impacted via the SDK and driver packages.

The CVSS score of 6.7 indicates moderate severity. The EPSS score is not available, so the likelihood of exploitation remains unknown. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet. The likely attack surface involves a local or elevated privilege attacker who can load or interact with the GPU driver, such as a malicious application or compromised user account. Consequently, the risk remains significant for systems where privileged users can be compromised.