The flaw resides in the kernel mode driver for NVIDIA GPU Display Driver on Windows and Linux. It allows a local user to read the GPU channel state of another process because the driver performs no authorization checks when handling certain requests. This missing check can expose confidential data that resides in the channel state, resulting in information disclosure. The weakness is a classic example of missing authorization (CWE-862).

Affected products include NVIDIA GeForce, RTX, Quadro, and NVS GPU hardware, as well as the corresponding NVIDIA GPU display drivers for both Windows and Linux. The malfunction also impacts the NVIDIA Guest driver and NVIDIA Virtual GPU Manager component. Specific firmware or driver versions are not listed in the advisory, so any release posted prior to the disclosure may be vulnerable.

The CVSS score of 5.5 indicates moderate severity. Because the attack can only be carried out by a local privileged user on the host, the risk to a remote attacker is limited. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation is not widely reported. Nonetheless, the information disclosure possible through the GPU channel could compromise sensitive graphics data, so the vulnerability remains a concern for systems where local users should not be able to inspect other processes' GPU state.