SB2025092950 - Multiple vulnerabilities in nVidia CUDA Toolkit

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025092950

SB2025092950 - Multiple vulnerabilities in nVidia CUDA Toolkit

Published: September 29, 2025

Security Bulletin ID SB2025092950
Severity
High
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 25% Medium 63% Low 13%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 secuirty vulnerabilities.


1) Out-of-bounds read (CVE-ID: CVE-2025-23340)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition in the nvdisasm binary. A remote attacker can use a specially crafted ELF file, trigger an out-of-bounds read error and cause a denial of service condition on the system.


2) NULL pointer dereference (CVE-ID: CVE-2025-23346)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in cuobjdump. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.


3) Heap-based buffer overflow (CVE-ID: CVE-2025-23308)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in nvdisasm in the REL section header parsing functionality. A remote attacker can trik a victim to run nvdisasm on a malicious ELF file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


4) Stack-based buffer overflow (CVE-ID: CVE-2025-23339)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in cuobjdump in the DWARF parsing functionality. A remote unauthenticated attacker can trick a victim to run cuobjdump on a malicious ELF file, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


5) Out-of-bounds read (CVE-ID: CVE-2025-23255)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in the cuobjdump binary. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.


6) Out-of-bounds read (CVE-ID: CVE-2025-23271)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition in the nvdisasm binary in the REL section header parsing functionality. A remote attacker can use a specially crafted ELF file, trigger an out-of-bounds read error and cause a denial of service condition on the system.


7) Out-of-bounds read (CVE-ID: CVE-2025-23248)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition in the nvdisasm binary. A remote attacker can use a specially crafted ELF file, trigger an out-of-bounds read error and cause a denial of service condition on the system.


8) Improper Validation of Array Index (CVE-ID: CVE-2025-23338)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in the symbol table parsing functionality in nvdisasm. A remote attacker can use a specially crafted ELF file and cause a denial of service condition on the target system.


Remediation

Install update from vendor's website.

References