Brief Summary: CVE-2026-24200 — NVIDIA vGPU Manager Use After Free Enables VM Escape

Introduction

A use-after-free vulnerability in the NVIDIA Virtual GPU Manager can allow a malicious guest VM to cross the virtualization boundary and compromise the hypervisor host, which puts every co-tenant on the same physical GPU at risk. Multi-tenant, GPU-virtualized infrastructure now spans a significant portion of enterprise data centers and cloud environments. For organizations running it, CVE-2026-24200 is a meaningful threat to the isolation guarantees their security model rests on.

NVIDIA's vGPU technology lets multiple virtual machines share a single physical GPU, and it is widely deployed for VDI, AI/ML training, and cloud computing workloads. NVIDIA holds an estimated 80%+ share of the GPU market, and the data center GPU market is projected to reach $34.73 billion in 2026, so a vulnerability in the vGPU Manager has a substantial blast radius.

Technical Information

Root Cause: Use After Free in Stack Memory

CVE-2026-24200 is classified under CWE-416 (Use After Free), a memory-safety flaw in which software references memory after it has been freed. The flaw is in the NVIDIA Virtual GPU Manager, the hypervisor-side component that mediates access between guest virtual machines and the physical GPU hardware. The use-after-free condition targets stack memory, a particularly sensitive region that holds function call frames, return addresses, and local variables.

When stack memory is freed but later referenced through a dangling pointer, the region may be reallocated for a different purpose. An attacker who can influence the contents of the reallocated region can then manipulate the program's execution flow when the original code dereferences the stale pointer. That mechanism accounts for the full range of impacts in the advisory: denial of service, escalation of privileges, information disclosure, data tampering, and code execution.

CVSS Vector Breakdown

The CVSS v3.1 vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, which breaks down as follows:

The most serious metric is Scope: Changed. It means a guest VM can affect the hypervisor host, crossing a fundamental trust boundary in virtualized environments. That turns what would otherwise be a guest-level privilege escalation into a full hypervisor compromise.

Sources disagree on the score. NVIDIA assigned a base score of 7.0, while Tenable and the NVD scored it 8.8. Both fall in the "High" severity range, and the gap comes from different assessments of the CVSS vector components. Tenable's Vulnerability Priority Rating (VPR) of 5.9 (Medium) adds threat intelligence context, including the current absence of known exploitation, which brings the real-world risk rating down.

Attack Flow

A typical exploitation would proceed like this:

1. The attacker gains access to a guest virtual machine running on a hypervisor with the NVIDIA vGPU Manager. The attacker could be a legitimate tenant in a multi-tenant cloud environment or could be using a compromised VM.

2. The attacker issues crafted GPU commands through the vGPU virtualization layer to trigger the use-after-free condition in the Virtual GPU Manager's stack memory handling. The vGPU Manager processes these commands in the hypervisor's privileged context, so the memory corruption happens at the hypervisor level.

3. After the stack memory is freed and reallocated, the attacker manipulates the contents of the reallocated region. When the vGPU Manager dereferences the stale pointer, it operates on attacker-controlled data.

4. Depending on the attacker's goal, the result could be arbitrary code execution with hypervisor-level privileges, access to other tenant VMs' memory, modification of host-level data, or a hypervisor crash that denies service to every hosted VM.

The specific GPU commands and code paths that trigger the vulnerability are not publicly documented, and no proof-of-concept exploit code has been published as of this analysis.

Patch Information

NVIDIA fixed CVE-2026-24200 in its Security Bulletin: NVIDIA GPU Display Drivers, May 2026 (bulletin ID 5821), first released on May 19, 2026, and revised through May 21, 2026. The fix is a closed-source binary patch distributed by the vendor. As is typical for proprietary NVIDIA driver updates, there is no public source code diff or commit to inspect.

CVE-2026-24200 is fixed only in the R595 and R580 driver branches. The older R535 long-term support branch gets no fix for this CVE, which is a critical consideration for administrators running legacy vGPU deployments.

Virtual GPU Manager (Hypervisor Side)

XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu:

Azure Local, Windows Server:

vGPU Guest Drivers

Windows:

Linux:

NVIDIA Cloud Gaming

For Cloud Gaming environments (Virtual GPU Manager on RHEL KVM and VMware vSphere), the fix ships in the April 2026 Release with driver version 595.71.03, which replaces the vulnerable March 2026 release (driver 595.58.02).

Distribution Channels

NVIDIA distributes updated Virtual GPU Manager packages through the NVIDIA Licensing Portal. Standard GPU display driver updates are available from the NVIDIA Driver Downloads page.

Remediation Notes

NVIDIA has confirmed that no workarounds are available, so driver updates are the only mitigation. CVE-2026-24200 is also one of 15 CVEs addressed in the May 2026 bulletin. Applying the complete set of fixes is strongly recommended, particularly because CVE-2026-24187 (CVSS 8.8, use after free in the Linux Display Driver) is a higher-severity flaw in the same bulletin.

For organizations that cannot patch immediately, the following compensating controls can reduce exposure. None of them fixes the underlying vulnerability.

• Restrict the GPU operations available to guest VMs where possible
• Make sure hypervisor-level memory isolation and virtualization sandboxing are configured correctly
• Deploy hypervisor-level monitoring to detect unusual GPU command patterns or unexpected VM-to-hypervisor interactions
• Reduce multi-tenant GPU sharing across different trust domains until patches are applied

Affected Systems and Versions

The vulnerability affects the NVIDIA Virtual GPU Manager across all supported hypervisor platforms:

vGPU Manager on XenServer, VMware vSphere, RHEL KVM, Ubuntu:

• vGPU software version 20.0 and earlier (driver ≤ 595.58.02) on the R595 branch
• vGPU software version 19.4 and earlier (driver ≤ 580.126.08) on the R580 branch
• vGPU software version 16.13 and earlier (driver ≤ 535.288.01) on the R535 branch (note: no fix available for R535)

vGPU Manager on Azure Local, Windows Server:

• vGPU software version 20.0 and earlier (driver ≤ 595.94) on the R595 branch
• vGPU software version 19.4 and earlier (driver ≤ 582.16) on the R580 branch

vGPU Guest Driver on Windows:

• vGPU software version 20.0 and earlier (driver ≤ 595.97) on the R595 branch
• vGPU software version 19.4 and earlier (driver ≤ 582.16) on the R580 branch
• vGPU software version 16.13 and earlier (driver ≤ 539.64) on the R535 branch

vGPU Guest Driver on Linux:

• vGPU software version 20.0 and earlier (driver ≤ 595.58.03) on the R595 branch
• vGPU software version 19.4 and earlier (driver ≤ 580.126.09) on the R580 branch
• vGPU software version 16.13 and earlier (driver ≤ 535.288.01) on the R535 branch

The affected hypervisor platforms are XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu, Azure Local, and Windows Server.

Vendor Security History

NVIDIA has a formal Product Security Incident Response Team (PSIRT) that publishes security bulletins on a regular schedule. Since October 1, 2025, NVIDIA PSIRT has published security bulletins on GitHub in Markdown, CSAF, and CVE formats, which makes the vulnerability data more transparent and machine-readable.

The vGPU Manager has a history of vulnerabilities with similar guest-to-hypervisor impact. One precedent is CVE-2025-23352, an uninitialized pointer access vulnerability in the Virtual GPU Manager that allowed a malicious guest VM to trigger access to an uninitialized pointer within the hypervisor's GPU management layer. The recurring guest-to-hypervisor escape vectors in the vGPU Manager suggest that the virtualization boundary between guest VMs and the GPU manager is still a source of security concern in NVIDIA's architecture.

NVIDIA vulnerabilities are regularly tracked at the national cybersecurity level. The CISA vulnerability summary for the week of January 26, 2026, for example, referenced NVIDIA security bulletins. The May 2026 bulletin that contains CVE-2026-24200 addresses 15 vulnerabilities in total, including CVE-2026-24187 (CVSS 8.8), a sign that the vGPU and GPU display driver stack is still an active area of security research and remediation.

References

• NVD: CVE-2026-24200
• CVE Record: CVE-2026-24200
• NVIDIA Security Bulletin: GPU Display Drivers, May 2026
• Tenable Plugin 316512: NVIDIA Virtual GPU Manager Multiple Vulnerabilities (May 2026)
• Tenable Plugin 316513: NVIDIA Windows GPU Display Driver (May 2026)
• SecurityOnline: GPU Security Alert, NVIDIA Drivers Hit with Critical 8.8 Vulnerability
• Hawk Eye: Weekly Threat Landscape Digest, Week 21
• CWE-416: Use After Free
• CISA Known Exploited Vulnerabilities Catalog
• NVIDIA Product Security
• NVIDIA Product Security GitHub Repository
• SentinelOne: CVE-2025-23352 NVIDIA vGPU Manager RCE Vulnerability
• NVIDIA Virtual GPU Solutions
• Data Center GPU Market Report