{"id":"CVE-2026-49747","kind":"vulnerability","aliases":["CVE-2026-49747"],"related":[],"title":"NVIDIA GPU driver: integer overflow lets local user write past GPU buffers","description":"Software installed and run as a non-privileged user may conduct GPU system calls to trigger an integer overflow and allow OOB writes to GPU buffers.\n\n\n\nThe integer overflow caused when mapping a GPU buffer >4GB causes corruption of array length, and can lead to kernel panics or out of bounds access.","summary":"A non-privileged program can issue GPU system calls that map a GPU buffer larger than 4GB, which overflows an integer and corrupts an array length. The result is out-of-bounds writes to GPU buffers, which can crash the kernel or read and write memory the program should not reach.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpu","infrastructure","kernel","linux","nvidia"],"not_affected_if":["no-nvidia-gpu","no-untrusted-local-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T03:17:30+00:00","first_seen_at":"2026-11-13T03:42:55+00:00","triaged_at":"2026-11-13T03:43:22+00:00","updated_at":"2026-11-13T03:43:22+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-13T03:43:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"NVIDIA GPU driver: integer overflow lets local user write past GPU buffers","impact":"high","summary":"A non-privileged program can issue GPU system calls that map a GPU buffer larger than 4GB, which overflows an integer and corrupts an array length. The result is out-of-bounds writes to GPU buffers, which can crash the kernel or read and write memory the program should not reach.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["nvidia","gpu","linux","kernel"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local program causes kernel panic or out-of-bounds memory access","analyst_note":"Check the NVIDIA security bulletin and the affected driver version ranges and fixed versions; the NVD entry gives only the description.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-local-users","no-nvidia-gpu"],"who_is_affected":"The sources do not name the affected driver versions or products beyond the NVIDIA GPU system call path. Systems with NVIDIA GPUs where untrusted local users or software run unprivileged workloads are the ones to look at. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000699,"input_tokens":4545,"output_tokens":488,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-49747':15A,18A '4gb':41B,113C 'access':129C 'allow':98C 'array':49B,117C 'bound':57B,128C 'buffer':12A,38B,61B,103C,112C 'call':33B,91C 'caus':107C,114C 'conduct':88C 'corrupt':47B,115C 'crash':64B 'cve':13A,16A 'driver':3A 'gpu':2A,11A,19B,31B,37B,60B,89C,102C,111C 'infrastructur':20B 'instal':78C 'integ':4A,45B,95C,105C 'issu':30B 'kernel':21B,66B,123C 'larger':39B 'lead':121C 'length':50B,118C 'let':6A 'linux':22B 'local':7A 'map':35B,109C 'may':87C 'memori':71B 'non':26B,84C 'non-privileg':25B,83C 'nvidia':1A,23B 'oob':99C 'out-of-bound':54B 'overflow':5A,43B,96C,106C 'panic':124C 'past':10A 'privileg':27B,85C 'program':28B,73B 'reach':76B 'read':68B 'result':52B 'run':80C 'softwar':77C 'system':32B,90C 'trigger':93C 'user':8A,86C 'write':9A,58B,70B,100C","nicknames":[],"mitigations":[],"who_affected":"The sources do not name the affected driver versions or products beyond the NVIDIA GPU system call path. Systems with NVIDIA GPUs where untrusted local users or software run unprivileged workloads are the ones to look at. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gpu","infrastructure","kernel","linux","nvidia","unknown"],"campaign_type":null,"search_a":"'-2026':14A,17A '-49747':15A,18A 'buffer':12A 'cve':13A,16A 'driver':3A 'gpu':2A,11A 'integ':4A 'let':6A 'local':7A 'nvidia':1A 'overflow':5A 'past':10A 'user':8A 'write':9A","search_b":"'4gb':41B 'array':49B 'bound':57B 'buffer':38B,61B 'call':33B 'corrupt':47B 'crash':64B 'gpu':19B,31B,37B,60B 'infrastructur':20B 'integ':45B 'issu':30B 'kernel':21B,66B 'larger':39B 'length':50B 'linux':22B 'map':35B 'memori':71B 'non':26B 'non-privileg':25B 'nvidia':23B 'out-of-bound':54B 'overflow':43B 'privileg':27B 'program':28B,73B 'reach':76B 'read':68B 'result':52B 'system':32B 'write':58B,70B","search_c":"'4gb':113C 'access':129C 'allow':98C 'array':117C 'bound':128C 'buffer':103C,112C 'call':91C 'caus':107C,114C 'conduct':88C 'corrupt':115C 'gpu':89C,102C,111C 'instal':78C 'integ':95C,105C 'kernel':123C 'lead':121C 'length':118C 'map':109C 'may':87C 'non':84C 'non-privileg':83C 'oob':99C 'overflow':96C,106C 'panic':124C 'privileg':85C 'run':80C 'softwar':77C 'system':90C 'trigger':93C 'user':86C 'write':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T03:17:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-49747","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49747","severity":null,"published_at":"2026-11-13T03:17:30+00:00","modified_at":"2026-11-13T03:17:30+00:00","first_seen_at":"2026-11-13T03:42:55+00:00","fetched_at":"2026-11-13T03:42:55+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}