NVIDIA Display Driver CVE-2025-23330

Exploitation requires an already-authenticated local user (PR:L, AV:L) on a Linux system running the NVIDIA Display Driver - there is no remote or network-reachable path and no user interaction by a victim is involved. The limiting factors are significant: the attacker must already have local code-execution/account access on the host, and the only achievable outcome is a denial of service against the local display/GPU subsystem (A:H, with C:N/I:N). No special non-default feature or configuration is named in the description; the flaw is in the driver itself, so any host with the vulnerable driver loaded is a candidate, but the local-privilege prerequisite sharply constrains realistic risk.

This is a moderate-severity, low-priority issue in practice. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) confines exploitation to a local attacker who already holds low-level privileges on the host, and the only impact is availability (denial of service) - there is no confidentiality or integrity loss. The EPSS score of 0.22% (11th percentile) reinforces that widespread exploitation is improbable, and the CVE is NOT on the CISA KEV list and has no public proof-of-concept, so there is no public exploit identified at time of analysis. No SSVC decision data was provided in the input. All signals are consistent and point the same direction: a genuine but low-urgency defect whose worst outcome is a local crash/hang of the display driver, not remote compromise. There are no conflicting signals to flag - the local vector, low privilege requirement, and availability-only impact in the description all align with the CVSS vector.

A local user with an existing low-privilege account on a Linux host running the NVIDIA display driver issues a crafted request or ioctl to the driver that reaches an unchecked code path, triggering a null pointer dereference. The dereference crashes or destabilizes the driver, producing a denial of service (e.g., GPU/display subsystem hang) on the local machine. No public exploit is known, and the attack cannot be performed remotely or without an existing local foothold.