NVIDIA vGPU
CVE-2025-23352
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain control of a provisioned guest VM
-
DeliveryCraft malicious guest-to-vGPU request
-
ExploitTrigger uninitialized pointer access in vGPU Manager
-
ExecutionDereference stale/uninitialized pointer
-
ImpactExecute code or crash manager on host side
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Uninitialized pointer prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already control a guest VM running on a hypervisor host where the NVIDIA Virtual GPU Manager (vGPU software) is installed and a vGPU is assigned to that guest - i.e. a multi-tenant or GPU-virtualized deployment. The attacker needs sufficient privilege inside the guest to issue GPU operations to the virtual device (PR:L), but no user interaction on the host and no network reachability. Limiting factors: this is NOT remotely exploitable over the network, it is confined to environments that actually deploy NVIDIA vGPU (bare consumer/passthrough GPU setups are not affected), and it requires a foothold in a guest; hosts without vGPU Manager or without untrusted guest tenants are not realistically exposed. |
| Impact | Signals are consistent and point to a moderate, non-urgent priority. The NVIDIA-supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local, low-complexity attack requiring low privileges and no user interaction, with high confidentiality, integrity, and availability impact - exactly what a memory-corruption flaw (CWE-824, uninitialized pointer access) in the Virtual GPU Manager would yield. The EPSS score is very low (0.18%, 7th percentile), indicating little observed or predicted exploitation activity, and the CVE is NOT in CISA KEV, so there is no public evidence of active exploitation. No public proof-of-concept is referenced in the provided data. The main tension worth noting: this is a guest-to-host escape class flaw (a malicious guest attacking the hypervisor-side vGPU Manager), which typically crosses a trust boundary, yet NVIDIA scored it S:U (scope unchanged) - defenders should treat the host-impact potential as real regardless of the scope metric. Overall this is a genuine but not emergency-grade issue: patch in normal cycles, prioritized by exposure of multi-tenant GPU virtualization. |
| Exploit ScenarioDerived | An attacker who controls a guest virtual machine on a host running NVIDIA vGPU software issues crafted operations to the virtual GPU, triggering an uninitialized pointer access inside the Virtual GPU Manager. Depending on how the stale pointer is dereferenced, this can crash the manager (denial of service for co-tenant guests) or potentially achieve code execution and privilege escalation on the host side. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Uninitialized pointer access in the NVIDIA Virtual GPU Manager lets a malicious guest VM running on a vGPU-enabled hypervisor host corrupt host-side memory, potentially achieving code execution in the hypervisor context, denial of service, privilege escalation, information disclosure, or data tampering. Per the CVSS vector (AV:L/PR:L/UI:N), exploitation requires an attacker to already control a guest with a vGPU assigned and to hold low privileges inside that guest; no network reachability or host-side user interaction is needed. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and EPSS is low at 0.18% (7th percentile), so this is a moderate, non-urgent priority concentrated in multi-tenant GPU-virtualized deployments.
RemediationAI
No vendor-released patch was identified from the provided input data, so the first step is to consult NVIDIA's security bulletin for CVE-2025-23352 (https://nvidia.custhelp.com/app/answers/detail/a_id/5703) and apply the fixed vGPU software release listed there for the exact driver branch in use - the advisory, not this record, is the source of the correct version number. Until that update is deployed, the most effective compensating control is to deny a vGPU to any guest or tenant you do not fully trust, since exploitation is only reachable from a guest that has a vGPU assigned; the trade-off is that GPU-accelerated workloads in those guests lose their virtual GPU and must fall back to CPU or be relocated. A stricter option is to bypass vGPU entirely for untrusted tenants and use dedicated GPU passthrough, which removes the shared vGPU Manager attack surface at the cost of losing GPU sharing density and multi-tenancy. Additionally, keep vGPU-enabled hosts segregated from untrusted tenant workloads, monitor host kernel and GPU driver logs for fault or crash patterns that could indicate guest-triggered memory corruption, and plan host restarts around the driver update since patching the Virtual GPU Manager requires remediation of the host stack.
Affected ProductsAI
The affected product is NVIDIA vGPU software, specifically the Virtual GPU Manager component installed on the hypervisor host that serves vGPU-enabled guests. No CPE identifiers were supplied in the input data and no version range is stated there, so the precise affected and fixed driver branches cannot be enumerated from this dataset; NVIDIA's security bulletin for CVE-2025-23352 (https://nvidia.custhelp.com/app/answers/detail/a_id/5703, also linked from NVD at https://nvd.nist.gov/vuln/detail/CVE-2025-23352 and the CVE record at https://www.cve.org/CVERecord?id=CVE-2025-23352) is the authoritative source for the exact impacted vGPU software versions and platform branches. Any host hosting untrusted or multi-tenant guests with vGPU assigned should be treated as in-scope until the applicable advisory entry is verified.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-824 'Access of Uninitialized Pointer' defect in NVIDIA's Virtual GPU Manager, the host-side component that mediates GPU access for virtual machines through vGPU/SR-IOV style mediated devices. When a guest issues GPU operations against its virtual device, those commands are parsed and handled by the vGPU Manager in the host kernel/driver stack; an uninitialized pointer in that path causes the host component to dereference attacker-influenced memory. Because the corruption occurs on the host side rather than inside the guest, the impact class spans host code execution, guest-to-host privilege escalation, host denial of service (crash/hang of the GPU or host), information disclosure, and data tampering, consistent with the CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector (high confidentiality, integrity, and availability impact with no scope change). The attack surface is limited to environments that actually deploy vGPU Manager with a vGPU assigned to an untrusted guest - bare consumer setups, GPU passthrough-only configurations, and hosts without the vGPU Manager are not reachable through this path.
Know when Nvidia gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Malicious guest acts locally via the vGPU interface (AV:L) with guest privileges (PR:L) and no interaction; uninitialized pointer access yields full host-side C/I/A impact; S:U retained per vendor though host-boundary crossing is arguable.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
DescriptionCVE.org
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause uninitialized pointer access. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Executive ViewAI
An unpatched memory-handling flaw in NVIDIA's Virtual GPU Manager affects organizations that share physical GPUs across multiple virtual machines, where an attacker who already controls a guest VM with a vGPU assigned can reach past the tenant boundary and corrupt memory on the hypervisor host, with potential for code execution, denial of service, or data tampering. The exposure is concentrated in cloud, VDI, and AI/ML estates where GPU capacity is pooled across different customers or trust levels, meaning a single compromised tenant could put other tenants on the same host at risk. No exploitation has been observed and NVIDIA has not yet shipped a fix, so leadership should treat this as a containment and readiness issue rather than an emergency.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict vGPU assignment to trusted tenants and guests only; separate untrusted workloads from shared GPU hosts or dedicate hosts per trust boundary; strip unnecessary local privileges and accounts inside vGPU guests; monitor hypervisor hosts for anomalous memory access, guest crashes, and unexpected host reboots; and maintain a standing process to deploy the NVIDIA vGPU Manager update immediately once released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres
The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary c
The NVIDIA driver before 307.78, and Release 310 before 311.00, in the NVIDIA Display Driver service on Windows does not
NVIDIA Windows GPU Display Driver (all versions) contains a vulnerability in DirectX drivers, in which a specially craft
Authentication bypass in NVIDIA Triton Inference Server allows unauthenticated remote attackers to reach protected funct
NVIDIA Windows GPU Display Driver (all versions) contains a vulnerability in DirectX drivers, in which a specially craft
NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability when used with default co
For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA GeForce Experience R340 before GFE 2.11.4.125 and R375 before G
The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and includ
The NVIDIA Graphics Drivers subsystem in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privi
NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with de
GitHub PoC
Exploit-DB