NVIDIA Windows GPU driver: unprivileged user causes an out-of-bounds write in the kernel mode layer

Impact

An unprivileged local user can write past a kernel allocation in the Windows GPU driver. NVIDIA lists code execution, privilege escalation and denial of service for this one, without the information-disclosure outcome attached to most of the bulletin, which is consistent with a write-only primitive. For an operator running Windows GPU guests, this is a straightforward in-guest path to SYSTEM.

Who can reach it

Local, unprivileged. Any user process on an affected Windows host or guest, including the guest driver inside a vGPU VM.

What to do

Apply the Windows driver branch from NVIDIA bulletin 2026/5861; the record names no fixed version. Reboot each updated Windows GPU instance, which requires draining it first.

References

Related entries

• NVIDIA Windows GPU driver: use-after-free in the kernel mode layerCVE-2026-47505 · NVIDIA GPU Display Driver for Windows (kernel mode layer)High
• NVIDIA open GPU kernel module: missing self-reference guard in map cleanup gives a use-after-freeCVE-2026-47597 · NVIDIA open GPU kernel module (Resource Server, map cleanup path)High
• NVIDIA open GPU kernel module: memory access permissions are lost during DMA mappingCVE-2026-47599 · NVIDIA open GPU kernel module for Linux (DMA mapping path)High
• NVIDIA GPU driver: error-handling path operates on an improperly initialized resourceCVE-2026-47600 · NVIDIA GPU Display Driver for Windows and Linux (kernel mode layer, error handling)High
• NVIDIA open GPU kernel module: read-only DMA-BUF imported from another device becomes writableCVE-2026-47601 · NVIDIA open GPU kernel module (DMA-BUF import path)High
• Linux kernel amdgpu user-mode queues (doorbell submission path) (drm/amdgpu): A double free in the amdgpu user-modeCVE-2026-52987 · Linux kernel amdgpu user-mode queues (doorbell submission path) (drm/amdgpu)High