CVE-2025-23351

9.0 Critique

Publiée le 01/07/2026 à 18:16 · Modifiée le 07/10/2026 à 00:10 · En attente d'analyse NVD · Source : psirt@nvidia.com

Description

NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bounds by crafted input. A successful exploit of this vulnerability may lead to arbitrary code execution on the device.

Traduire en français

Produits concernés

NVIDIA BlueField GA
NVIDIA BlueField LTS22
NVIDIA BlueField LTS23
NVIDIA BlueField LTS24
NVIDIA ConnectX GA
NVIDIA ConnectX LTS22
NVIDIA ConnectX LTS23
NVIDIA ConnectX LTS24
NVIDIA ConnectX-4
NVIDIA ConnectX-4 LX

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.0 Critique	psirt@nvidia.com	`CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-787

Références

https://github.com/NVIDIA/product-security/tree/main/2026/5699
https://nvd.nist.gov/vuln/detail/CVE-2025-23351
https://www.cve.org/CVERecord?id=CVE-2025-23351

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories