CVE-2025-23339Low· 3.3▾ TwilightPoC availableNVIDIA CUDA Toolkit for all platforms contains a vulnerability in cuobjdump where an attacker may cause a stack-based buffer overflow by getting the user to run cuobjdump on a malicious ELF file. A successful exploit of this vulnerabilit…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 18.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Sep 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
1 GitHub repo (last check)
NVIDIA CUDA Toolkit for all platforms contains a vulnerability in cuobjdump where an attacker may cause a stack-based buffer overflow by getting the user to run cuobjdump on a malicious ELF file. A successful exploit of this vulnerability may lead to arbitrary code execution at the privilege level of the user running cuobjdump.
cuda_toolkit < 13.0.0Upgrade past the affected range:
cuda_toolkit 13.0.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-65148High· 7.3NVIDIA DALI contains a vulnerability where an attacker could cause a stack-based buffer overflow
CVE-2026-47593High· 7.8NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer where an unprivileged user can cause an out-of-bounds write
CVE-2026-47486High· 7.8NVIDIA PhysX for all platforms contains a vulnerability where an attacker could cause an out-of-bounds write
CVE-2026-65145Critical· 10.0NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue
CVE-2026-65151High· 8.4NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injection issue
CVE-2026-65119High· 8.4NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusion of functionality from an untrusted control sphere