NVIDIA's May 2026 Driver Vulnerabilities: The CVEs, and Who Was Actually at Risk

On May 19, 2026, NVIDIA published a security bulletin covering vulnerabilities across its GPU Display Driver stack. The coverage that followed was loud, and most of it skipped the only two numbers that matter: which driver version you are running, and which one contains the fix.

Here they are up front.

If you are on Windows with a modern GeForce card, driver 596.36 or newer already contains these fixes. If you are on older GeForce GTX hardware, the equivalent is 582.53 or later. If you let GeForce Experience or the NVIDIA App update you automatically, you were almost certainly never exposed.

That is the whole practical answer. The rest is what was actually found and who genuinely needed to worry.

What the bulletin covered

The flaws sit in the kernel-mode driver and in how the driver handles GPU resources — the layer that runs with high privilege and talks straight to your hardware. That privilege level is why driver bugs get taken seriously even when they are hard to exploit.

The named issues, with their scores:

• CVE-2026-24187 — use-after-free in the Linux display driver. CVSS 8.8, the highest in the set.
• CVE-2026-24190 — improper GPU resource access, Windows and Linux. CVSS 7.8.
• CVE-2026-24191 — time-of-check/time-of-use flaw, Windows display driver. CVSS 7.8.
• CVE-2026-24192 — heap buffer overflow, Linux display driver. CVSS 7.8.
• CVE-2026-24193 — out-of-bounds write, Windows and Linux. CVSS 7.8.
• CVE-2026-24200 — use-after-free in stack memory, vGPU software. CVSS 7.0.

Those scores and classifications come from NVIDIA's own bulletin. Depending on the CVE, successful exploitation could mean denial of service, privilege escalation, information disclosure, data tampering or code execution.

Affected product lines ran well beyond gaming: GeForce, Quadro workstation cards, Tesla server parts, NVS, and NVIDIA's vGPU and Cloud Gaming software. The fixes shipped across the R595, R590, R580, R570 and R535 branches on both Windows and Linux.

The part the headlines got wrong

Read the affected-version lists and a pattern emerges that most write-ups buried: these are vulnerabilities in older driver branches. The patched versions were already shipping. The population genuinely at risk was never "everyone with an RTX card."

It was people who pin drivers deliberately. That is a real and substantial group — Linux workstations on a distro-packaged driver, render farms and studios that validate one driver version and freeze it for a project, enterprise vGPU deployments on a maintenance branch, and anyone who installed once in 2024 and never opened the updater again.

A gamer who lets the NVIDIA App update itself was patched before the bulletin was public. A studio running a locked R535 build for pipeline stability was the actual audience.

The highest-scoring flaw in the set, CVE-2026-24187 at 8.8, is a Linux display driver bug. The Windows issues top out at 7.8. That detail alone reorders who should have been paying attention, and it was widely dropped in favour of a generic "NVIDIA users must update now."

Why driver bugs score high in the first place

A CVSS of 7.8 or 8.8 on a graphics driver sounds alarming next to, say, a browser bug of the same score. The reason is placement, not exoticism.

Display drivers run in kernel mode. Code executing there is not subject to the boundaries that contain a normal application — it sits underneath the user-account model, underneath most endpoint protection, with direct hardware access. A use-after-free or out-of-bounds write in that layer is a privilege-escalation primitive: the path from "malicious code is already running as a normal user" to "malicious code owns the machine."

That last clause matters and is routinely omitted. None of these CVEs is a remote-attack vector. Nothing here lets someone compromise your PC because you loaded a web page or joined a game server. They are local escalation bugs — dangerous as the second stage of an attack, useless as the first.

Where you should be now

That bulletin is from May. The driver landscape has moved since, and the version numbers above are floors, not targets.

NVIDIA has since opened the R610 branch, and 610.47 WHQL shipped on May 26, 2026 — the release that also retired the classic NVIDIA Control Panel after twenty years and moved everything into the NVIDIA App. Anything on R610 or later is comfortably past this bulletin.

To check where you stand, open the NVIDIA App and look at the driver version under the Drivers tab, or run nvidia-smi on Linux. Compare it against the floors above.

The habit worth building

NVIDIA publishes these bulletins on a regular cadence — there was a January 2026 bulletin before this one, and there will be more. They are all listed on NVIDIA's product security page, which is the source worth bookmarking rather than any individual news story about it.

The sensible posture is unglamorous: keep automatic driver updates on unless you have a specific reason not to, and if you do pin a driver for stability, put a recurring reminder in the calendar to check the bulletin list against your pinned version. The people who pin are precisely the people these advisories are written for, and they are the least likely to see a consumer news headline about it.

For everyone else, the honest summary of May 2026 is that the system worked. The bugs were found, scored, patched and shipped through the normal update channel — and if you had not touched a setting, you were already fine.