NVIDIA Display Driver CVE-2025-23332

Exploitation requires LOCAL access to a system running the NVIDIA Display Driver for Linux, a low-privileged authenticated account (CVSS PR:L), and user interaction (CVSS UI:R) to reach the vulnerable kernel-module code path. It is not remotely exploitable and cannot be triggered by an unauthenticated attacker. The description does not name a specific feature, protocol, or non-default configuration setting - it states only that an attacker interacting with a kernel module might trigger a null pointer dereference. Impact is limited to denial of service (A:H only; no confidentiality or integrity impact), so the realistic worst case is a driver/system crash, not code execution or data compromise.

This is a low-to-moderate priority issue despite its MEDIUM 5.0 CVSS score, and the available signals are mutually consistent rather than conflicting. The CVSS vector (AV:L/AC:L/PR:L/UI:R) describes a local, low-privileged, user-interaction-dependent attack with no confidentiality or integrity impact and only high availability impact (C:N/I:N/A:H) - i.e., a pure denial-of-service via kernel null pointer dereference. The EPSS score of 0.14% (3rd percentile) reinforces this low real-world threat, indicating very low likelihood of exploitation activity. The CVE is NOT listed in CISA KEV and there is no public exploit code identified, so there is no evidence of active exploitation or weaponization. No SSVC decision data was provided in the input. The only meaningful impact is a local crash/hang of the display driver (and potentially the host if the kernel panics), which an unprivileged local user could already cause in many ways; this is not a remote or privilege-escalation threat. Patch availability is implied by the NVIDIA advisory reference (custhelp answer a_id/5703) but the exact fixed driver version is not stated in the provided data.

A local user with a standard (low-privilege) account on a Linux system running the NVIDIA proprietary display driver interacts with the vulnerable kernel module in a way that reaches an unguarded pointer, triggering a null pointer dereference. The resulting kernel fault crashes or destabilizes the graphics driver, denying service to the system or GPU workloads. No public proof-of-concept exploit is identified at the time of analysis.