NVIDIA Virtual GPU Manager contains a use-after-free vulnerability (CWE-416) in its handling of stack memory. This vulnerability affects all versions up to and including the March 2026 release (version 595.58.02). Exploitation could lead to multiple impacts including denial of service, privilege escalation, information disclosure, data tampering, and code execution. The CVSS 3.1 base score is 7.0, reflecting a high severity with local attack vector, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No patch or official remediation has been published yet.

Successful exploitation of this use-after-free vulnerability could allow an attacker with local access and low privileges to cause denial of service, escalate privileges, disclose sensitive information, tamper with data, or execute arbitrary code on the affected system. This could compromise the confidentiality, integrity, and availability of the system running the NVIDIA Virtual GPU Manager.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released by NVIDIA, users should limit access to systems running affected versions of the Virtual GPU Manager and monitor for any unusual activity. No vendor-provided mitigation or temporary fix is currently available.