NVIDIA Windows GPU driver: incorrect buffer size calculation in the kernel mode layer

Impact

The driver computes a buffer size incorrectly, so the allocation does not match what is later written into or read from it. The result is the usual overflow or over-read in kernel memory, triggered by a local attacker. On Windows GPU instances the kernel mode driver runs at SYSTEM, so a successful overflow ends the privilege question for that host or guest.

Who can reach it

Local. Any user process on an affected Windows system able to call the driver.

What to do

Apply the Windows driver branch from NVIDIA bulletin 2026/5861; no fixed version appears in this record. Reboot each updated instance; Virtual GPU Manager is also listed among affected products and needs its own maintenance window.

References

Related entries

• NVIDIA Windows GPU driver: use-after-free with a scope-changing impact beyond the vulnerable componentCVE-2026-47579 · NVIDIA GPU Display Driver for Windows (kernel mode driver)High
• NVIDIA Windows GPU driver: type confusion in the kernel moduleCVE-2026-47583 · NVIDIA GPU Display Driver for Windows (kernel module)High
• NVIDIA Windows GPU driver: integer underflow in the kernel moduleCVE-2026-47585 · NVIDIA GPU Display Driver for Windows (kernel module, size arithmetic)High
• NVIDIA Linux GPU driver: incorrect authorization lets an unprivileged user write read-only memoryCVE-2026-47591 · NVIDIA GPU Display Driver for Linux (kernel mode layer, read-only memory authorization)High
• NVIDIA Windows GPU driver: unprivileged user causes an out-of-bounds write in the kernel mode layerCVE-2026-47593 · NVIDIA GPU Display Driver for Windows (kernel mode layer)High
• NVIDIA open GPU kernel module: missing self-reference guard in map cleanup gives a use-after-freeCVE-2026-47597 · NVIDIA open GPU kernel module (Resource Server, map cleanup path)High