CVE-2025-23350

State: Published
Severity: 9.0 Critical
Published: Jul 1, 2026
Updated: Jul 1, 2026
Reserved: Jan 14, 2025

Description

NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bounds by crafted input. A successful exploit of this vulnerability may lead to arbitrary code execution on the device.

Scores

CVSS	Score	Vector	Source
3.1	9.0 Critical	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	nvidia

Weaknesses

CWE-787 Out-of-bounds Write

Affected Products

Product	Versions
BlueField GANVIDIA	All versions prior to 46.3008Affected
BlueField LTS22NVIDIA	All versions prior to 35.8002Affected
BlueField LTS23NVIDIA	All versions prior to 39.8002Affected
BlueField LTS24NVIDIA	All versions prior to 43.8002Affected
ConnectX GANVIDIA	All versions prior to 46.3008Affected
ConnectX LTS22NVIDIA	All versions prior to 35.8002Affected
ConnectX LTS23NVIDIA	All versions prior to 39.8002Affected
ConnectX LTS24NVIDIA	All versions prior to 43.8002Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.