CVE-2026-24191 is a TOCTOU race condition vulnerability in NVIDIA GeForce display drivers for Windows versions before 596.36. The flaw arises from a timing issue between checking a condition and using the result, which can be exploited by an attacker with local access and low privileges. Successful exploitation can lead to a range of impacts including denial of service, privilege escalation, information disclosure, data tampering, and arbitrary code execution. The vulnerability is rated high severity with a CVSS 3.1 score of 7.8, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation has been announced as of the publication date.

If exploited, this vulnerability could allow an attacker with local access and low privileges to escalate their privileges, execute arbitrary code, cause denial of service, disclose sensitive information, or tamper with data on affected systems running vulnerable NVIDIA GeForce drivers. The vulnerability affects all driver versions prior to 596.36. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the NVIDIA vendor advisory for current remediation guidance. Until an official fix is released, users should limit local access to trusted individuals and monitor for updates from NVIDIA. No official workaround or temporary fix has been provided.