The vulnerability CVE-2026-47498 exists in the NVIDIA Virtual GPU Manager's GPU System Processor (GSP) plugin. A guest virtual machine user can send a specially crafted remote procedure call (RPC) message that causes an out-of-bounds write, classified under CWE-787. This memory corruption flaw can potentially allow attackers to execute arbitrary code, escalate privileges, tamper with data, cause denial of service, or disclose sensitive information. The CVSS v3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, requiring low privileges and no user interaction. The scope is unchanged, and the impact on confidentiality, integrity, and availability is high.

Successful exploitation allows a guest VM user to perform out-of-bounds writes in the GPU System Processor plugin, which may result in arbitrary code execution, privilege escalation, data tampering, denial of service, and information disclosure. This can compromise the confidentiality, integrity, and availability of the affected system.

No patch or remediation information is currently provided. Patch status is not yet confirmed — check the NVIDIA vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected Virtual GPU Manager and limit guest VM capabilities to reduce risk.