NVIDIA Windows GPU driver: use-after-free with a scope-changing impact beyond the vulnerable component

Impact

A local user can trigger a use-after-free in the Windows kernel mode driver. This one carries a different CVSS vector from the rest of the bulletin: high attack complexity but a changed scope, meaning successful exploitation affects resources beyond the driver itself. On a virtualized GPU host that is the shape of a guest-to-host or cross-boundary impact, so do not lump it in with the ordinary in-guest escalations even though the score matches.

Who can reach it

Local, low privilege, high attack complexity. A user on an affected Windows system; the guest driver is listed among affected products.

What to do

Apply the Windows driver update from NVIDIA bulletin 2026/5861; no fixed version is stated here. Reboot each updated Windows host or guest, which means draining the instance first.

References

Related entries

• NVIDIA Windows GPU driver: type confusion in the kernel moduleCVE-2026-47583 · NVIDIA GPU Display Driver for Windows (kernel module)High
• NVIDIA Windows GPU driver: integer underflow in the kernel moduleCVE-2026-47585 · NVIDIA GPU Display Driver for Windows (kernel module, size arithmetic)High
• NVIDIA Linux GPU driver: incorrect authorization lets an unprivileged user write read-only memoryCVE-2026-47591 · NVIDIA GPU Display Driver for Linux (kernel mode layer, read-only memory authorization)High
• NVIDIA Windows GPU driver: unprivileged user causes an out-of-bounds write in the kernel mode layerCVE-2026-47593 · NVIDIA GPU Display Driver for Windows (kernel mode layer)High
• NVIDIA open GPU kernel module: missing self-reference guard in map cleanup gives a use-after-freeCVE-2026-47597 · NVIDIA open GPU kernel module (Resource Server, map cleanup path)High
• NVIDIA open GPU kernel module: memory access permissions are lost during DMA mappingCVE-2026-47599 · NVIDIA open GPU kernel module for Linux (DMA mapping path)High