NVIDIA GPU Display Driver for Windows and Linux contains a use‑after‑free flaw that can be triggered by an unprivileged local user sending a specific sequence of driver commands. Exploitation may allow arbitrary code execution, privilege escalation, denial of service, or information disclosure. The weakness is classified as CWE‑416 and CWE‑825.

Affects NVIDIA GeForce, RTX, Quadro, NVS, and Tesla GPU families on both Windows and Linux platforms. The vulnerability applies to all driver versions included in the current distribution; no mitigations are available in the released firmware.

The CVSS score of 7.8 indicates a high impact, while the EPSS score is not available, making it difficult to gauge current exploitation probability. The flaw is not listed in the CISA KEV catalog, suggesting no active widespread attacks yet. The attack vector is local, requiring only normal user privileges to send the vulnerable driver commands, so the threat surface includes any endpoint where the affected GPU driver is installed. Due to the potential for privilege escalation, operators should consider restricting local driver access or applying mitigations until a vendor patch is issued.