NVIDIA GPU Display Driver for Windows and Linux contains a flaw in the kernel-mode component that allows a local user to trigger the driver to copy kernel memory that has not been properly initialized back into user space. This results in unintended exposure of kernel data such as internal structure contents, which can reveal sensitive information about the system state. The CVSS score of 5.5 indicates moderate severity: the vulnerability does not grant arbitrary code execution and is confined to information disclosure.

All NVIDIA graphics products that rely on the affected driver, including GeForce, RTX, Quadro, NVS, Tesla, the Guest Driver, and the Virtual GPU Manager. Exact version numbers are not listed in the advisory, so any installation that has not yet applied the latest driver update remains vulnerable.

The impact hinges on the ability to load the vulnerable driver, which typically requires administrative privileges or local user control over driver installation. Because the exploit relies on an uninitialized memory copy, it does not require complex inputs and could be triggered by a simple driver call. The EPSS metric is not reported, and the vulnerability is not in CISA's KEV catalog, suggesting limited public exploitation data. Nonetheless, the CVSS score reflects that a successful exploitation would compromise confidentiality but not integrity or availability.