CVE-2025-23272

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-23272", "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "state": "PUBLISHED", "assignerShortName": "nvidia", "dateReserved": "2025-01-14T01:06:24.332Z", "datePublished": "2025-09-24T13:11:59.673Z", "dateUpdated": "2025-09-24T18:44:17.110Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows", "Linux"], "product": "NVIDIA CUDA Toolkit", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "All versions prior to CUDA Toolkit 12.9 Update 1"}]}, {"defaultStatus": "unaffected", "platforms": ["Linux x86_64", "Linux sbsa Jetson", "Windows", "Linux for Tegra", "DriveOS"], "product": "nvJPEG", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "All versions prior to nvJPEG 25.03"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": true, "type": "text/html", "value": "NVIDIA nvJPEG library contains a vulnerability where an attacker can cause an out-of-bounds read by means of a specially crafted JPEG file. A successful exploit of this vulnerability might lead to information disclosure or denial of service."}], "value": "NVIDIA nvJPEG library contains a vulnerability where an attacker can cause an out-of-bounds read by means of a specially crafted JPEG file. A successful exploit of this vulnerability might lead to information disclosure or denial of service."}], "impacts": [{"descriptions": [{"lang": "en", "value": "Information disclosure, denial of service"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "shortName": "nvidia", "dateUpdated": "2025-09-24T13:11:59.673Z"}, "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23272"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-23272"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5661"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "NVIDIA PSIRT"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-24T18:44:09.549946Z", "id": "CVE-2025-23272", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-24T18:44:17.110Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-23272", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-24T18:44:09.549946Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-24T18:44:14.039Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "impacts": [{"descriptions": [{"lang": "en", "value": "Information disclosure, denial of service"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NVIDIA", "product": "NVIDIA CUDA Toolkit", "versions": [{"status": "affected", "version": "All versions prior to CUDA Toolkit 12.9 Update 1"}], "platforms": ["Windows", "Linux"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "nvJPEG", "versions": [{"status": "affected", "version": "All versions prior to nvJPEG 25.03"}], "platforms": ["Linux x86_64", "Linux sbsa Jetson", "Windows", "Linux for Tegra", "DriveOS"], "defaultStatus": "unaffected"}], "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23272"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-23272"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5661"}], "x_generator": {"engine": "NVIDIA PSIRT"}, "descriptions": [{"lang": "en", "value": "NVIDIA nvJPEG library contains a vulnerability where an attacker can cause an out-of-bounds read by means of a specially crafted JPEG file. A successful exploit of this vulnerability might lead to information disclosure or denial of service.", "supportingMedia": [{"type": "text/html", "value": "NVIDIA nvJPEG library contains a vulnerability where an attacker can cause an out-of-bounds read by means of a specially crafted JPEG file. A successful exploit of this vulnerability might lead to information disclosure or denial of service.", "base64": true}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "shortName": "nvidia", "dateUpdated": "2025-09-24T13:11:59.673Z"}}}, "cveMetadata": {"cveId": "CVE-2025-23272", "state": "PUBLISHED", "dateUpdated": "2025-09-24T18:44:17.110Z", "dateReserved": "2025-01-14T01:06:24.332Z", "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "datePublished": "2025-09-24T13:11:59.673Z", "assignerShortName": "nvidia"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows", "Linux"], "product": "NVIDIA CUDA Toolkit", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "All versions prior to CUDA Toolkit 12.9 Update 1"}]}, {"defaultStatus": "unaffected", "platforms": ["Linux x86_64", "Linux sbsa Jetson", "Windows", "Linux for Tegra", "DriveOS"], "product": "nvJPEG", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "All versions prior to nvJPEG 25.03"}]}], "source": "psirt@nvidia.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NVIDIA nvJPEG library contains a vulnerability where an attacker can cause an out-of-bounds read by means of a specially crafted JPEG file. A successful exploit of this vulnerability might lead to information disclosure or denial of service."}, {"lang": "es", "value": "La biblioteca nvJPEG de NVIDIA contiene una vulnerabilidad donde un atacante puede causar una lectura fuera de l\u00edmites mediante un archivo JPEG especialmente dise\u00f1ado. Un exploit exitoso de esta vulnerabilidad podr\u00eda conducir a la revelaci\u00f3n de informaci\u00f3n o a la denegaci\u00f3n de servicio."}], "id": "CVE-2025-23272", "lastModified": "2026-09-26T00:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.4, "impactScore": 4.2, "source": "psirt@nvidia.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-23272", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-24T18:44:09.549946Z", "version": "2.0.3"}}]}, "published": "2025-09-24T14:15:47.203", "references": [{"source": "psirt@nvidia.com", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23272"}, {"source": "psirt@nvidia.com", "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5661"}, {"source": "psirt@nvidia.com", "url": "https://www.cve.org/CVERecord?id=CVE-2025-23272"}], "sourceIdentifier": "psirt@nvidia.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "psirt@nvidia.com", "type": "Secondary"}]}

{}

{"created": "2025-09-25T08:21:23.732841+00:00", "updated": "2025-09-25T08:21:23.732896+00:00", "vendors": ["nvidia", "nvidia$PRODUCT$cuda_toolkit", "nvidia$PRODUCT$nvjpeg"]}