CVE-2025-23351

CriticalCVSS 9.0/10Last modified Oct 6, 2026

Description

NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bounds by crafted input. A successful exploit of this vulnerability may lead to arbitrary code execution on the device.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
NVIDIABlueField GAAll versions prior to 46.3008
NVIDIABlueField LTS22All versions prior to 35.8002
NVIDIABlueField LTS23All versions prior to 39.8002
NVIDIABlueField LTS24All versions prior to 43.8002
NVIDIAConnectX GAAll versions prior to 46.3008
NVIDIAConnectX LTS22All versions prior to 35.8002
NVIDIAConnectX LTS23All versions prior to 39.8002
NVIDIAConnectX LTS24All versions prior to 43.8002
NVIDIAConnectX-4All versions prior to 28.4702
NVIDIAConnectX-4 LXAll versions prior to 32.1908

References

Timeline

Published
Jul 1, 2026
Last modified
Oct 6, 2026
NVD status
Awaiting Analysis

Related CVEs from 2025

CVE-2025-233527.8NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause uninitialized pointer access. CVE-2025-233537.8NVIDIA Megatron-LM for all platforms contains a vulnerability in the msdp preprocessing script where malicious data created by an attacker mCVE-2025-233547.8NVIDIA Megatron-LM for all platforms contains a vulnerability in the ensemble_classifer script where malicious data created by an attacker mCVE-2025-233557.8NVIDIA Nsight Graphics for Windows contains a vulnerability in an ngfx component, where an attacker could cause a DLL highjacking attack. A CVE-2025-233568.4NVIDIA Isaac Lab contains a vulnerability in SB3 configuration parsing. A successful exploit of this vulnerability might lead to code executCVE-2025-233577.8NVIDIA Megatron-LM for all platforms contains a vulnerability in a script, where malicious data created by an attacker may cause a code injeCVE-2025-233588.2NVIDIA NVApp for Windows contains a vulnerability in the installer, where a local attacker can cause a search path element issue. A successfCVE-2025-233598.1NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability when used with default configuration, where aCVE-2025-23364.8Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS's 'ngSanitize' module alCVE-2025-233609.8NVIDIA Nemo Framework contains a vulnerability where a user could cause a relative path traversal issue by arbitrary file write. A successfuCVE-2025-233617.8NVIDIA NeMo Framework for all platforms contains a vulnerability in a script, where malicious input created by an attacker may cause impropeCVE-2025-233626.1The old versions of EXIF Viewer Classic contain a cross-site scripting vulnerability caused by improper handling of EXIF meta data. When an
CVE-2025-23351: Critical severity, CVSS 9.0 | Vulnix