An attacker that has local, unprivileged access can trigger a use‑after‑free in the open‑source kernel module Resource Server of NVIDIA GPU Display Drivers. The flaw stems from a missing self‑reference guard in the map cleanup path and is classified as CWE‑416 and CWE‑825. Successful exploitation can lead to arbitrary code execution, elevation of privileges, denial of service, information disclosure, and data tampering.

All NVIDIA graphics cards, including GeForce, RTX, Quadro, NVS, Tesla, and the Guest driver, on both Windows and Linux are potentially affected. The CVE does not list specific driver versions, implying that the vulnerability may exist across a broad range of releases that incorporate the Resource Server module.

The CVSS score of 7.8 indicates a moderate‑to‑high severity. EPSS data is unavailable, so the precise likelihood of exploitation is unknown, but the vulnerability is local and could be leveraged by any user with access to the machine. The flaw is not currently listed in CISA’s KEV catalog. Because it is a use‑after‑free, a local attacker can gain code execution or privilege escalation without additional prerequisites.