PT-2026-54609 · Nvidia · Connect+1

Published 2026-07-01 · Updated 2026-07-02 · CVE-2025-23351

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NVIDIA ConnectX (affected versions not specified) NVIDIA BlueField (affected versions not specified)

Description A flaw exists in the command interface that allows a local user with virtual function (VF) access to trigger a write out of bounds by providing crafted input. This condition can lead to arbitrary code execution on the device.

Recommendations Apply the latest security patches for NVIDIA ConnectX. Apply the latest security patches for NVIDIA BlueField.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2025-23351

Affected Products

Bluefield

Connect

References · 4

• https://cve.org/CVERecord?id=CVE-2025-23351 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-23351 · Security Note
• https://github.com/NVIDIA/product-security/tree/main/2026/5699 · Note
• https://twitter.com/the_yellow_fall/status/2072491832110661910 · Twitter Post