CVE-2025-23278
NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker might...
NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker might cause an improper index validation by issuing a call with crafted parameters. A successful exploit of this vulnerability might lead to data tampering or denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker might cause an improper index validation by issuing a call with crafted parameters. A successful exploit of this vulnerability might lead to data tampering or denial of service.
- Record
CVE-2025-23278- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-129
- Updated
- 2026-11-02
EUVDEUVD-2025-23450
NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker might cause an improper index validation by issuing a call with crafted parameters. A successful exploit of this vulnerability might lead to data tampering or denial of service.
- Record
EUVD-2025-23450- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-58v5-wj5r-7vmx
NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker might...
NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker might cause an improper index validation by issuing a call with crafted parameters. A successful exploit of this vulnerability might lead to data tampering or denial of service.
- Record
GHSA-58v5-wj5r-7vmx- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-129
- Updated
- 2026-11-02
NVD
NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker might cause an improper index validation by issuing a call with crafted parameters. A successful exploit of this vulnerability might lead to data tampering or denial of service.
- Record
CVE-2025-23278- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-129
- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15431-1 No score
nvidia-open-driver-G06-signed-default-devel-570.172.08-2.1 on GA media
These are all security issues fixed in the nvidia-open-driver-G06-signed-default-devel-570.172.08-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15431-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15804-1 No score
nvidia-open-driver-G07-signed-check-590.44.01-1.1 on GA media
These are all security issues fixed in the nvidia-open-driver-G07-signed-check-590.44.01-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15804-1- Updated
- 2026-11-02
Show 6 moreShow less
OSVSUSE-SU-2025:03062-1 No score
Security update for nvidia-open-driver-G06-signed
This update for nvidia-open-driver-G06-signed fixes the following issues:
Updated CUDA variant to 580.65.06:
- CVE-2025-23277: Fixed access memory outside bounds permitted under normal use cases in NVIDIA Display Driver (bsc#1247528)
- CVE-2025-23278: Fixed improper index validation by issuing a call with crafted parameters in NVIDIA Display Driver (bsc#1247529)
- CVE-2025-23286: Fixed invalid memory read in NVIDIA GPU Display Driver (bsc#1247530)
- CVE-2025-23283: Fixed stack buffer overflow triggerable by a malicious guest in Virtual GPU Manager in NVIDIA vGPU software (bsc#1247531)
- CVE-2025-23279: Fixed race condition that lead to privileges escalations in NVIDIA .run Installer (bsc#1247532)
Updated non-CUDA variant to 570.172.08 (bsc#1246327)
- Record
SUSE-SU-2025:03062-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:03246-1 No score
Security update for nvidia-open-driver-G06-signed
This update for nvidia-open-driver-G06-signed fixes the following issues:
Updated CUDA variant to 580.82.07:
- CVE-2025-23277: Fixed access to memory outside bounds permitted under normal use cases in NVIDIA Display Driver (bsc#1247528).
- CVE-2025-23278: Fixed improper index validation by issuing a call with crafted parameters in NVIDIA Display Driver (bsc#1247529).
- CVE-2025-23286: Fixed invalid memory read in NVIDIA GPU Display Driver (bsc#1247530).
- CVE-2025-23283: Fixed stack buffer overflow triggerable by a malicious guest in Virtual GPU Manager in NVIDIA vGPU software (bsc#1247531).
- CVE-2025-23279: Fixed race condition that leads to privileges escalations in NVIDIA .run Installer (bsc#1247532).
Update non-CUDA variant to 580.82.07 (bsc#1249235).
Other fixes:
- Added Requires to be provided by special versions of nvidia-modprobe and nvidia-persitenced built against SP4 (bsc#1237208, jsc#PED-13295).
- Get rid of rule of older KMPs not to load nvidia_drm module,
which are still installed in parallel and therefore still
active (bsc#1247923).
- Record
SUSE-SU-2025:03246-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:03247-1 No score
Security update for nvidia-open-driver-G06-signed
This update for nvidia-open-driver-G06-signed fixes the following issues:
Updated CUDA variant to 580.82.07:
- CVE-2025-23277: Fixed access memory outside bounds permitted under normal use cases in NVIDIA Display Driver (bsc#1247528).
- CVE-2025-23278: Fixed improper index validation by issuing a call with crafted parameters in NVIDIA Display Driver (bsc#1247529).
- CVE-2025-23286: Fixed invalid memory read in NVIDIA GPU Display Driver (bsc#1247530).
- CVE-2025-23283: Fixed stack buffer overflow triggerable by a malicious guest in Virtual GPU Manager in NVIDIA vGPU software (bsc#1247531).
- CVE-2025-23279: Fixed race condition that lead to privileges escalations in NVIDIA .run Installer (bsc#1247532).
Update non-CUDA variant to 580.82.07 (bsc#1249235).
Other fixes:
- Added Requires to be provided by special versions of nvidia-modprobe and nvidia-persitenced built against SP4 (bsc#1237208, jsc#PED-13295).
- Get rid of rule of older KMPs not to load nvidia_drm module,
which are still installed in parallel and therefore still
active (bsc#1247923).
- Record
SUSE-SU-2025:03247-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:03424-1 No score
Security update for nvidia-open-driver-G06-signed
This update for nvidia-open-driver-G06-signed fixes the following issues:
Updated CUDA variant to 580.82.07:
- CVE-2025-23277: Fixed access memory outside bounds permitted under normal use cases in NVIDIA Display Driver (bsc#1247528).
- CVE-2025-23278: Fixed improper index validation by issuing a call with crafted parameters in NVIDIA Display Driver (bsc#1247529).
- CVE-2025-23286: Fixed invalid memory read in NVIDIA GPU Display Driver (bsc#1247530).
- CVE-2025-23283: Fixed stack buffer overflow triggerable by a malicious guest in Virtual GPU Manager in NVIDIA vGPU software (bsc#1247531).
- CVE-2025-23279: Fixed race condition that lead to privileges escalations in NVIDIA .run Installer (bsc#1247532).
Update non-CUDA variant to 580.82.07 (bsc#1249235).
Other fixes:
- Added Requires to be provided by special versions of nvidia-modprobe and nvidia-persitenced built against SP4 (bsc#1237208, jsc#PED-13295).
- Get rid of rule of older KMPs not to load nvidia_drm module, which are still installed in parallel and therefore still active (bsc#1247923).
- Record
SUSE-SU-2025:03424-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:20741-1 No score
Security update for nvidia-open-driver-G06-signed
This update for nvidia-open-driver-G06-signed fixes the following issues:
Update non-CUDA variant to 580.82.07 (bsc#1249235)
Update non-CUDA variant to 580.76.05 (bsc#1247907)
- get rid of rule of older KMPs not to load nvidia_drm module, which are still installed in parallel and therefore still active (bsc#1247923)
Update CUDA variant to 580.65.06, which addresses various security issues:
- CVE-2025-23277 (bsc#1247528)
- CVE-2025-23278 (bsc#1247529)
- CVE-2025-23286 (bsc#1247530)
- CVE-2025-23283 (bsc#1247531)
- CVE-2025-23279 (bsc#1247532)
Update non-CUDA variant to 570.172.08 (bsc#1246327)
-
empty pci_ids-570.169; PCI ID hardware Supplements get moved to gfx repository to package nvidia-open-driver-G06-signed-kmp-meta (bsc#1246010)
-
remove 60-nvidia-$flavor.conf, since driver no longer gets autoselected without gfx/cuda repositories present and so we no longer need to disable it by default (bsc#1246010)
- Record
SUSE-SU-2025:20741-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:20757-1 No score
Security update for nvidia-open-driver-G06-signed
This update for nvidia-open-driver-G06-signed fixes the following issues:
Update non-CUDA variant to 580.82.07 (bsc#1249235)
Update non-CUDA variant to 580.76.05 (bsc#1247907)
- get rid of rule of older KMPs not to load nvidia_drm module, which are still installed in parallel and therefore still active (bsc#1247923)
Update CUDA variant to 580.65.06, which addresses various security issues:
- CVE-2025-23277 (bsc#1247528)
- CVE-2025-23278 (bsc#1247529)
- CVE-2025-23286 (bsc#1247530)
- CVE-2025-23283 (bsc#1247531)
- CVE-2025-23279 (bsc#1247532)
Update non-CUDA variant to 570.172.08 (bsc#1246327)
-
empty pci_ids-570.169; PCI ID hardware Supplements get moved to gfx repository to package nvidia-open-driver-G06-signed-kmp-meta (bsc#1246010)
-
remove 60-nvidia-$flavor.conf, since driver no longer gets autoselected without gfx/cuda repositories present and so we no longer need to disable it by default (bsc#1246010)
- Record
SUSE-SU-2025:20757-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nvidia-open-driver-G06-signedSUSE:Linux Enterprise Micro 5.5 From an advisory covering 5 CVEs |
before 570.172.08-150500.3.73.7 | 570.172.08-150500.3.73.7 |
nvidia-open-driver-G06-signed-cudaSUSE:Linux Enterprise Micro 5.5 From an advisory covering 5 CVEs |
before 580.65.06-150500.3.73.7 | 580.65.06-150500.3.73.7 |
nvidia-open-driver-G06-signedSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 5 CVEs |
before 570.172.08-150500.3.73.7 | 570.172.08-150500.3.73.7 |
nvidia-open-driver-G06-signed-cudaSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 5 CVEs |
before 580.65.06-150500.3.73.7 | 580.65.06-150500.3.73.7 |
nvidia-open-driver-G06-signedSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 5 CVEs |
before 570.172.08-150500.3.73.7 | 570.172.08-150500.3.73.7 |
nvidia-open-driver-G06-signed-cudaSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 5 CVEs |
before 580.65.06-150500.3.73.7 | 580.65.06-150500.3.73.7 |
nvidia-open-driver-G06-signedSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 5 CVEs |
before 570.172.08-150500.3.73.7 | 570.172.08-150500.3.73.7 |
nvidia-open-driver-G06-signed-cudaSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 5 CVEs |
before 580.65.06-150500.3.73.7 | 580.65.06-150500.3.73.7 |
nvidia-open-driver-G06-signedSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 5 CVEs |
before 570.172.08-150500.3.73.7 | 570.172.08-150500.3.73.7 |
nvidia-open-driver-G06-signed-cudaSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 5 CVEs |
before 580.65.06-150500.3.73.7 | 580.65.06-150500.3.73.7 |
Show 30 moreShow less
| Package | Affected | Fixed |
|---|---|---|
nvidia-open-driver-G06-signedSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 5 CVEs |
before 580.82.07-150700.3.21.1 | 580.82.07-150700.3.21.1 |
nvidia-open-driver-G06-signed-cudaSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 5 CVEs |
before 580.82.07-150700.3.21.1 | 580.82.07-150700.3.21.1 |
nvidia-open-driver-G06-signedSUSE:Linux Enterprise Module for Basesystem 15 SP6 From an advisory covering 5 CVEs |
before 580.82.07-150600.3.63.1 | 580.82.07-150600.3.63.1 |
nvidia-open-driver-G06-signed-cudaSUSE:Linux Enterprise Module for Basesystem 15 SP6 From an advisory covering 5 CVEs |
before 580.82.07-150600.3.63.1 | 580.82.07-150600.3.63.1 |
nvidia-open-driver-G06-signedSUSE:Linux Enterprise Module for Public Cloud 15 SP6 From an advisory covering 5 CVEs |
before 580.82.07-150600.3.63.1 | 580.82.07-150600.3.63.1 |
nvidia-open-driver-G06-signed-cudaSUSE:Linux Enterprise Module for Public Cloud 15 SP6 From an advisory covering 5 CVEs |
before 580.82.07-150600.3.63.1 | 580.82.07-150600.3.63.1 |
nvidia-open-driver-G06-signed-cudaSUSE:Linux Enterprise Module for Public Cloud 15 SP7 From an advisory covering 5 CVEs |
before 580.82.07-150600.3.63.1 | 580.82.07-150600.3.63.1 |
nvidia-open-driver-G06-signedopenSUSE:Leap 15.6 From an advisory covering 5 CVEs |
before 580.82.07-150600.3.63.1 | 580.82.07-150600.3.63.1 |
nvidia-open-driver-G06-signed-cudaopenSUSE:Leap 15.6 From an advisory covering 5 CVEs |
before 580.82.07-150600.3.63.1 | 580.82.07-150600.3.63.1 |
nvidia-open-driver-G06-signedSUSE:Linux Enterprise Micro 5.3 From an advisory covering 5 CVEs |
before 580.82.07-150400.98.1 | 580.82.07-150400.98.1 |
nvidia-open-driver-G06-signed-cudaSUSE:Linux Enterprise Micro 5.3 From an advisory covering 5 CVEs |
before 580.82.07-150400.98.1 | 580.82.07-150400.98.1 |
nvidia-open-driver-G06-signedSUSE:Linux Enterprise Micro 5.4 From an advisory covering 5 CVEs |
before 580.82.07-150400.98.1 | 580.82.07-150400.98.1 |
nvidia-open-driver-G06-signed-cudaSUSE:Linux Enterprise Micro 5.4 From an advisory covering 5 CVEs |
before 580.82.07-150400.98.1 | 580.82.07-150400.98.1 |
nvidia-open-driver-G06-signedSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 5 CVEs |
before 580.82.07-150400.98.1 | 580.82.07-150400.98.1 |
nvidia-open-driver-G06-signed-cudaSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 5 CVEs |
before 580.82.07-150400.98.1 | 580.82.07-150400.98.1 |
nvidia-open-driver-G06-signedSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 5 CVEs |
before 580.82.07-150400.98.1 | 580.82.07-150400.98.1 |
nvidia-open-driver-G06-signed-cudaSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 5 CVEs |
before 580.82.07-150400.98.1 | 580.82.07-150400.98.1 |
nvidia-open-driver-G06-signedSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 5 CVEs |
before 580.82.07-150400.98.1 | 580.82.07-150400.98.1 |
nvidia-open-driver-G06-signed-cudaSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 5 CVEs |
before 580.82.07-150400.98.1 | 580.82.07-150400.98.1 |
nvidia-open-driver-G06-signedSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 5 CVEs |
before 580.82.07-150400.98.1 | 580.82.07-150400.98.1 |
nvidia-open-driver-G06-signedSUSE:Manager Proxy LTS 4.3 From an advisory covering 5 CVEs |
before 580.82.07-150400.98.1 | 580.82.07-150400.98.1 |
nvidia-open-driver-G06-signed-cudaSUSE:Manager Proxy LTS 4.3 From an advisory covering 5 CVEs |
before 580.82.07-150400.98.1 | 580.82.07-150400.98.1 |
nvidia-open-driver-G06-signedSUSE:Manager Server LTS 4.3 From an advisory covering 5 CVEs |
before 580.82.07-150400.98.1 | 580.82.07-150400.98.1 |
nvidia-open-driver-G06-signed-cudaSUSE:Manager Server LTS 4.3 From an advisory covering 5 CVEs |
before 580.82.07-150400.98.1 | 580.82.07-150400.98.1 |
nvidia-open-driver-G06-signedSUSE:Linux Micro 6.0 From an advisory covering 5 CVEs |
before 580.82.07-1.1 | 580.82.07-1.1 |
nvidia-open-driver-G06-signed-cudaSUSE:Linux Micro 6.0 From an advisory covering 5 CVEs |
before 580.82.07-1.1 | 580.82.07-1.1 |
nvidia-open-driver-G06-signedSUSE:Linux Micro 6.1 From an advisory covering 5 CVEs |
before 580.82.07-1.1 | 580.82.07-1.1 |
nvidia-open-driver-G06-signed-cudaSUSE:Linux Micro 6.1 From an advisory covering 5 CVEs |
before 580.82.07-1.1 | 580.82.07-1.1 |
nvidia-open-driver-G06-signedopenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 570.172.08-2.1 | 570.172.08-2.1 |
nvidia-open-driver-G07-signedopenSUSE:Tumbleweed From an advisory covering 9 CVEs |
before 590.44.01-1.1 | 590.44.01-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-23278 is a high vulnerability (CVSS 7.1) in Nvidia Gpu Display Drivers, published August 2, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. No source names a fixed version.
References
nvidia.custhelp.com/app/answers/detail/a_id/5670
nvd.nist.gov/vuln/detail/CVE-2025-23278
github.com/advisories/GHSA-58v5-wj5r-7vmx
suse.com/support/update/announcement/2025/suse-su-202503062-1
bugzilla.suse.com/1236191
Show 34 moreShow less