PT-2025-40051 · Go · Github.Com/Nvidia/Gpu-Operator+3

Published 2025-07-17 · Updated 2025-07-17

OSV

CVSS v3.1

9.0

Critical

Base vector

AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could execute arbitrary code with elevated permissions. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, information disclosure, and denial of service.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

GHSA-VMG3-7V43-9G23

Affected Products

Github.Com/Nvidia/Gpu-Operator

Github.Com/Nvidia/K8S-Device-Plugin

Github.Com/Nvidia/Mig-Parted

Github.Com/Nvidia/Nvidia-Container-Toolkit

References · 12

• https://osv.dev/vulnerability/GHSA-vmg3-7v43-9g23 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-23266 · Security Note
• https://github.com/NVIDIA/k8s-device-plugin · Note
• https://github.com/NVIDIA/nvidia-container-toolkit · Note
• https://github.com/NVIDIA/gpu-operator · Note
• https://github.com/NVIDIA/mig-parted · Note
• https://wiz.io/blog/nvidia-ai-vulnerability-cve-2025-23266-nvidiascape · Note
• https://pkg.go.dev/vuln/GO-2025-3992 · Note
• https://news.ycombinator.com/item?id=44818412 · Note
• https://kidbomb.github.io/posts/nvidia-container-escape-cve-2025-23266-part-2 · Note
• https://nvidia.custhelp.com/app/answers/detail/a_id/5659 · Note
• https://kidbomb.github.io/posts/nvidia-container-escape-cve-2025-23266 · Note