CVE-2025-23266

CRITICAL9.0

NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could execute arbitrary code with elevated permissions

Published Jul 17, 2025

Modified 5 months ago

No fix available

Details

NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could execute arbitrary code with elevated permissions. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, information disclosure, and denial of service.

References

WEBhttps://kidbomb.github.io/posts/nvidia-container-escape-cve-2025-23266-part-2/WEBhttps://kidbomb.github.io/posts/nvidia-container-escape-cve-2025-23266/WEBhttps://news.ycombinator.com/item?id=44818412 WEBhttps://nvidia.custhelp.com/app/answers/detail/a_id/5659 ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2025-23266 WEBhttps://www.wiz.io/blog/nvidia-ai-vulnerability-cve-2025-23266-nvidiascape

CVSS Analysis

CVSS v3.1

9.0

Exploitability

Attack Vector

AdjacentAV:A

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

ChangedS:C

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

9/CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness Type (CWE)

Other

CWE-426

Ecosystems

Timeline

PublishedJul 17, 2025

ModifiedAug 16, 2025