PT-2025-39255 · Nvidia+2 · Nvidia Cuda Toolkit+3

Published 2025-09-22 · Updated 2025-10-31 · CVE-2025-23308

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NVIDIA CUDA Toolkit (affected versions not specified)

Description The NVIDIA CUDA Toolkit contains an issue in the nvdisasm component. An attacker can trigger a heap-based buffer overflow by providing a malicious ELF file to nvdisasm. Successful exploitation may result in arbitrary code execution with the privileges of the user running nvdisasm.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

BDU:2025-12628

CVE-2025-23308

Affected Products

Debian

Nvidia Cuda Toolkit

Red Os

Nvdisasm

References · 16

• https://osv.dev/vulnerability/UBUNTU-CVE-2025-23308 · Vendor Advisory
• https://nvidia.custhelp.com/app/answers/detail/a_id/5661 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-23308 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-23308 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-23308 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-23308 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-23308 · Security Note
• https://bdu.fstec.ru/vul/2025-12628 · Security Note
• https://osv.dev/vulnerability/CVE-2025-23308 · Vendor Advisory
• https://t.me/CVEtracker/33248 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-cuda-nvdisasm-31102025 · Note
• https://talosintelligence.com/vulnerability_reports/TALOS-2025-2204 · Note
• https://twitter.com/CVEnew/status/1970848933552304290 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-cuda-nvdisasm-31102025/?sphrase_id=1338622 · Note
• https://t.me/cveNotify/137509 · Telegram Post