CVE-2025-23294

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

NVIDIA WebDataset for all platforms contains a vulnerability where an attacker could execute arbitrary code with elevated permissions. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, information disclosure, and denial of service.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
NVIDIANVIDIA WebDatasetAll versions that do not include code commit 9e95f50

References

Timeline

Published
Aug 13, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-232957.8NVIDIA Apex for all platforms contains a vulnerability in a Python component where an attacker could cause a code injection issue by providiCVE-2025-232967.8NVIDIA Isaac-GR00T for all platforms contains a vulnerability in a Python component where an attacker could cause a code injection issue. A CVE-2025-232977.8NVIDIA Installer for NvAPP for Windows contains a vulnerability in the FrameviewSDK installation process, where an attacker with local unpriCVE-2025-232987.8NVIDIA Merlin Transformers4Rec for all platforms contains a vulnerability in a python dependency, where an attacker could cause a code injecCVE-2025-232996.7NVIDIA Bluefield and ConnectX contain a vulnerability in the management interface that could allow a malicious actor with high privilege accCVE-2025-23305.4The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button+mCVE-2025-233005.5NVIDIA Display Driver for Linux contains a vulnerability in the kernel driver, where a user could cause a null pointer dereference by allocaCVE-2025-233014.2NVIDIA HGX and DGX contain a vulnerability where a misconfiguration of the VBIOS could enable an attacker to set an unsafe debug access leveCVE-2025-233024.2NVIDIA HGX and DGX contain a vulnerability where a misconfiguration of the LS10 could enable an attacker to set an unsafe debug access levelCVE-2025-233039.8NVIDIA NeMo Framework for all platforms contains a vulnerability where a user could cause a deserialization of untrusted data by remote codeCVE-2025-233049.8NVIDIA NeMo library for all platforms contains a vulnerability in the model loading component, where an attacker could cause code injection CVE-2025-233057.8NVIDIA Megatron-LM for all platforms contains a vulnerability in the tools component, where an attacker may exploit a code injection issue.
CVE-2025-23294: High severity, CVSS 7.8 | Vulnix