The vulnerability lies in the kernel mode component of the NVIDIA GPU Display Driver for both Windows and Linux. Improper validation of input data could allow an adversary to trigger a code execution path, potentially leading to denial of service, escalation of privileges, and both information disclosure and data tampering. The weakness is a classic input validation flaw, identified as CWE-20, that permits the attacker to manipulate internal driver state through malicious requests.

All NVIDIA GPU families listed by the CNA are affected: GeForce, RTX, Quadro, NVS, and Tesla. The driver runs on both Windows and Linux platforms. Specific affected driver releases or versions were not provided in the data, so any NVIDIA GPU Display Driver shared among these product lines could be vulnerable.

The CVSS score of 6.7 indicates a medium to high risk. EPSS information is not available, and the vulnerability is not in CISA’s KEV catalog, so the likelihood of widespread exploitation is uncertain. The attack vector is not explicit in the description; based on the kernel‑mode nature of the flaw, it is inferred that a local attacker or one with some level of privileged access to the system would be required to supply the malicious input that triggers the vulnerability.