NVIDIA Windows GPU Display Driver, DirectX driver (shader compiler/runtime): A crafted shader overruns a shader-local

Impact

A crafted shader overruns a shader-local temporary array, giving code execution in the graphics driver. Same delivery surface as the texture-array bug: wherever attacker-authored shaders reach your GPUs, this is remote code execution against the host driver.

Who can reach it

Anyone able to submit shaders - remote/VDI session users, tenant VMs, or local processes.

What to do

Install the fixed Windows GPU Display Driver branch listed in the NVIDIA bulletin. nvlddmkm.sys is a kernel driver: the swap needs a host reboot, so on a Windows GPU node this is a drain-and-reboot, not a live driver reload. No VBIOS or BMC flash involved.

References