NVIDIA Display Driver CVE-2025-23345

Exploitation requires the attacker to already have local, low-privileged access to a system running the NVIDIA Display Driver (AV:L, PR:L) and the ability to submit a crafted/malformed video stream to the driver's video decoder component - the decoding path is the specific feature that must be reachable and invoked. No user interaction is required (UI:N). Limiting factors that reduce real-world risk: the vulnerability is NOT remotely exploitable, the attacker must first establish a local foothold with at least low privileges, and impact is confined to the local system (S:U, no scope change). Systems without the NVIDIA driver installed, or where an unprivileged attacker cannot reach the decoder, are not exposed.

This is a low-to-moderate priority issue despite the attention NVIDIA driver CVEs often attract. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 4.4 MEDIUM) describes a local, low-complexity attack requiring already-held low privileges on the host - it is not remotely reachable. EPSS reinforces low urgency at 0.16% (5th percentile), indicating negligible predicted exploitation activity. The CVE is not listed in CISA KEV and no public exploit code is referenced, so there is no evidence of active exploitation or weaponization. One notable internal inconsistency: the description states the impact 'might lead to information disclosure or denial of service,' yet NVIDIA's vector encodes C:N (no confidentiality impact) and I:L (low integrity) - information disclosure from an out-of-bounds read normally maps to a confidentiality (C) impact, not integrity, so the vendor's metric assignment appears mismatched with its own prose; defenders should treat the 'information disclosure' outcome as a confidentiality concern regardless of the encoded C:N. No SSVC decision data was provided. Overall: a real but local, authenticated, low-impact memory-safety defect best handled via routine patch cycles rather than emergency response.

A local attacker who already has a low-privileged account on a Windows or Linux system running the NVIDIA Display Driver feeds a specially crafted or malformed video stream to the vulnerable video decoder component. The decoder performs an out-of-bounds read, either leaking adjacent process/driver memory contents or crashing the driver and causing a denial of service. No public proof-of-concept is referenced, and because the attack vector is local (AV:L) the attacker must first obtain code execution or interactive access on the target.