CVE-2025-23274
NVIDIA nvJPEG contains a vulnerability in jpeg encoding where a user may cause an out-of-bounds...
NVIDIA nvJPEG contains a vulnerability in jpeg encoding where a user may cause an out-of-bounds read by providing a maliciously crafted input image with dimensions that cause integer overflows in array index calculations. A successful exploit of this vulnerability may lead to denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
NVIDIA nvJPEG contains a vulnerability in jpeg encoding where a user may cause an out-of-bounds read by providing a maliciously crafted input image with dimensions that cause integer overflows in array index calculations. A successful exploit of this vulnerability may lead to denial of service.
- Record
CVE-2025-23274- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2025-30974
NVIDIA nvJPEG contains a vulnerability in jpeg encoding where a user may cause an out-of-bounds read by providing a maliciously crafted input image with dimensions that cause integer overflows in array index calculations. A successful exploit of this vulnerability may lead to denial of service.
- Record
EUVD-2025-30974- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wgw9-m369-f899
NVIDIA nvJPEG contains a vulnerability in jpeg encoding where a user may cause an out-of-bounds...
NVIDIA nvJPEG contains a vulnerability in jpeg encoding where a user may cause an out-of-bounds read by providing a maliciously crafted input image with dimensions that cause integer overflows in array index calculations. A successful exploit of this vulnerability may lead to denial of service.
- Record
GHSA-wgw9-m369-f899- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
NVIDIA nvJPEG contains a vulnerability in jpeg encoding where a user may cause an out-of-bounds read by providing a maliciously crafted input image with dimensions that cause integer overflows in array index calculations. A successful exploit of this vulnerability may lead to denial of service.
- Record
CVE-2025-23274- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-23274
NVIDIA nvJPEG contains a vulnerability in jpeg encoding where a user may cause an out-of-bounds read by providing a maliciously crafted input image with dimensions that cause integer overflows in array index calculations. A successful exploit of this vulnerability may lead to denial of service.
- Record
DEBIAN-CVE-2025-23274- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-23274
NVIDIA nvJPEG contains a vulnerability in jpeg encoding where a user may cause an out-of-bounds read by providing a maliciously crafted input image with dimensions that cause integer overflows in array index calculations. A successful exploit of this vulnerability may lead to denial of service.
- Record
UBUNTU-CVE-2025-23274- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nvidia-cuda-toolkitDebian:12 |
All versions, plus listed versions 10.0.130-110.0.130-210.0.130-310.1.105-110.1.105-2 Show 45 moreShow less10.1.105-310.1.168-110.1.168-1010.1.168-1110.1.168-210.1.168-310.1.168-410.1.168-510.1.168-610.1.168-710.1.168-7~bpo10+110.1.168-810.1.168-910.1.243-110.1.243-210.1.243-310.1.243-410.1.243-510.1.243-610.1.243-6~bpo10+110.1.243-710.1.243-810.2.89-110.2.89-210.2.89-310.2.89-410.2.89-510.2.89-5~bpo10+111.0.2-111.0.3-111.0.3-211.0.3-311.1.0-111.1.1-111.1.1-211.1.1-311.1.1-3~bpo10+111.1.1-411.2.0-111.2.0-211.2.0-2~bpo10+111.2.1-111.2.1-211.2.1-2~bpo10+111.2.2-1 |
None known |
nvidia-cuda-toolkitDebian:13 |
All versions, plus listed versions 10.0.130-110.0.130-210.0.130-310.1.105-110.1.105-2 Show 45 moreShow less10.1.105-310.1.168-110.1.168-1010.1.168-1110.1.168-210.1.168-310.1.168-410.1.168-510.1.168-610.1.168-710.1.168-7~bpo10+110.1.168-810.1.168-910.1.243-110.1.243-210.1.243-310.1.243-410.1.243-510.1.243-610.1.243-6~bpo10+110.1.243-710.1.243-810.2.89-110.2.89-210.2.89-310.2.89-410.2.89-510.2.89-5~bpo10+111.0.2-111.0.3-111.0.3-211.0.3-311.1.0-111.1.1-111.1.1-211.1.1-311.1.1-3~bpo10+111.1.1-411.2.0-111.2.0-211.2.0-2~bpo10+111.2.1-111.2.1-211.2.1-2~bpo10+111.2.2-1 |
None known |
nvidia-cuda-toolkitUbuntu:16.04:LTS |
All versions, plus listed versions 6.5.14-26.5.19-27.0.28-17.0.28-27.0.28-2ubuntu17.5.18-0ubuntu1 |
None known |
nvidia-cuda-toolkitUbuntu:18.04:LTS |
All versions, plus listed versions 8.0.61-18.0.61-28.0.61-39.0.176-29.1.85-19.1.85-2ubuntu19.1.85-39.1.85-3ubuntu1 |
None known |
nvidia-cuda-toolkitUbuntu:20.04:LTS |
All versions, plus listed versions 10.1.168-1build110.1.168-210.1.168-310.1.243-1ubuntu210.1.243-1ubuntu310.1.243-210.1.243-3 |
None known |
nvidia-cuda-toolkitUbuntu:22.04:LTS |
All versions, plus listed versions 11.3.1-411.3.1-511.4.3-111.4.3-1build111.5.1-1build111.5.1-1ubuntu1 |
None known |
nvidia-cuda-toolkitUbuntu:24.04:LTS |
All versions, plus listed versions 12.0.1-212.0.1-312.0.1-412.0.1-4build112.0.1-4build312.0.1-4build4 |
None known |
libnvjpeg-13-3Ubuntu:26.10 |
All versions, plus listed versions 13.2.1.68-0ubuntu1 |
None known |
nvidia-cuda-toolkitUbuntu:26.10 |
All versions, plus listed versions 12.4.1-812.4.1-8.112.4.1-8.212.4.1-8.2build112.4.1-8.2ubuntu112.4.1-8.2ubuntu2 |
None known |
nvidia-cuda-toolkitUbuntu:26.04:LTS |
All versions, plus listed versions 12.4.1-4build112.4.1-512.4.1-6build112.4.1-6build212.4.1-8 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-23274 is a medium vulnerability (CVSS 4.5) in Nvidia Nvjpeg, published September 24, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 2nd percentile. No source names a fixed version.
References
Left out here: 330 versions. The JSON record has them.