The vulnerability is in the NVIDIA GPU Display Driver for Windows, specifically in the display driver DIAG escape handler. The flaw allows a local unprivileged attacker to trigger an integer overflow that results in an out‑of‑bounds write. An attacker could use this to crash the driver, causing a denial of service, or to execute arbitrary code with the privileges of the driver, leading to escalated compromise. The weakness is a classic buffer overflow (CWE‑787).

The affected systems are NVIDIA GPU Display Drivers running on Windows for a wide range of NVIDIA GPUs, including GeForce, RTX, Quadro, NVS, and Tesla products. Exact version information is not provided, meaning all current Windows drivers for these GPUs should be considered vulnerable until an official patch is released.

The CVSS score of 7.8 places the vulnerability in the high severity range. Because the attack requires local and unprivileged access, the exploitation window may be limited to users with physical access or compromised local accounts. EPSS information is not available, and the vulnerability is not currently listed in the CISA KEV catalog, so widespread exploitation at this time is not documented. Nevertheless, the potential for local code execution and denial of service warrants prompt attention. The attack path involves an attacker interacting with the driver through the vulnerable escape handler, making the vulnerability feasible for a local attacker who can send crafted requests to the driver interface.