Home » Database

AVID-2026-R1186

Description

Vulnerability CVE-2023-25512

Details

NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in cuobjdump, where an attacker may cause an out-of-bounds memory read by running cuobjdump on a malformed input file. A successful exploit of this vulnerability may lead to limited denial of service, code execution, and limited information disclosure.

Reason for inclusion in AVID: CVE-2023-25512 describes a vulnerability in NVIDIA CUDA Toolkit’s cuobjdump that allows an attacker to trigger an out-of-bounds read, potentially enabling code execution or information disclosure. CUDA Toolkit is a core software dependency used to build, train, deploy, and run AI systems (GPUs, libraries, and toolchains). This is a software supply-chain issue within a component commonly used in AI pipelines, not a hardware/firmware-only vulnerability. The CVE indicates plausible exploitation (local, with user interaction) affecting the software stack of AI workloads.

References

Affected or Relevant Artifacts

  • Developer: NVIDIA
  • Deployer: NVIDIA
  • Artifact Details:
TypeName
SystemNVIDIA CUDA Toolkit

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.1
Vector StringCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Base Score5.3
Base Severity🟠 Medium
Attack VectorLOCAL
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality Impact🟢 Low
Integrity Impact🟢 Low
Availability Impact🟢 Low

CWE

IDDescription
CWE-125CWE-125 Out-of-bounds Read

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2023-04-22
  • Version: 0.3.3
  • AVID Entry