{"id":"CVE-2026-47486","kind":"vulnerability","aliases":["CVE-2026-47486"],"related":[],"title":"NVIDIA PhysX: out-of-bounds write lets an attacker run code","description":"NVIDIA PhysX for all platforms contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, information disclosure.","summary":"NVIDIA PhysX, the physics simulation engine used in games and simulation software, contains an out-of-bounds write flaw. A successful attack could lead to code execution, data tampering, denial of service, or information disclosure.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["games","nvidia-physx","runtime","simulation"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-27T13:16:57+00:00","first_seen_at":"2026-10-27T13:31:51+00:00","triaged_at":"2026-10-27T13:32:14+00:00","updated_at":"2026-10-27T13:32:14+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-27T13:32:14Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"NVIDIA PhysX: out-of-bounds write lets an attacker run code","impact":"high","summary":"NVIDIA PhysX, the physics simulation engine used in games and simulation software, contains an out-of-bounds write flaw. A successful attack could lead to code execution, data tampering, denial of service, or information disclosure.","category":"runtime","nicknames":[],"who_cares":["nvidia-physx","games","simulation"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker runs code on the affected machine via memory corruption","analyst_note":"Find the NVIDIA security bulletin and the fixed PhysX SDK or driver version, and check the attack vector and whether user interaction or local access is needed (https://nvd.nist.gov/vuln/detail/CVE-2026-47486).","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000524,"input_tokens":3297,"output_tokens":389,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-47486':15A,18A 'attack':10A,47B,71C 'bound':6A,42B,78C 'caus':73C 'code':12A,51B,89C 'contain':37B,66C 'could':48B,72C 'cve':13A,16A 'data':53B,91C 'denial':55B,93C 'disclosur':60B,97C 'engin':30B 'execut':52B,90C 'exploit':82C 'flaw':44B 'game':19B,33B 'inform':59B,96C 'lead':49B,87C 'let':8A 'might':86C 'nvidia':1A,21B,25B,61C 'nvidia-physx':20B 'out-of-bound':3A,39B,75C 'physic':28B 'physx':2A,22B,26B,62C 'platform':65C 'run':11A 'runtim':23B 'servic':57B,95C 'simul':24B,29B,35B 'softwar':36B 'success':46B,81C 'tamper':54B,92C 'use':31B 'vulner':68C,85C 'write':7A,43B,79C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T13:16:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@nvidia.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-47486","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47486","severity":null,"published_at":"2026-10-27T13:16:57+00:00","modified_at":"2026-10-27T13:16:57+00:00","first_seen_at":"2026-10-27T13:31:51+00:00","fetched_at":"2026-10-27T13:31:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}