CVE-2023-25517

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-04 · updated 2026-06-17
Weakness: CWE-285

Description

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a guest OS may be able to control resources for which it is not authorized, which may lead to information disclosure and data tampering.

Affected products

NVIDIA Guest driver: before 11.13; from 13.0 before 13.8; from 15.0 before 15.3 — fixed in 11.13, 13.8, 15.3

How to fix

Upgrade to a fixed version: NVIDIA Guest driver 11.13, 13.8, 15.3. Check the vendor advisory for mitigations.

References

https://nvidia.custhelp.com/app/answers/detail/a_id/5468
https://nvidia.custhelp.com/app/answers/detail/a_id/5468

Get alerted when CVE-2023-25517 or the next vulnerability affects your stack