NVIDIA vulnerabilities
We track 582 vulnerabilities in NVIDIA products across 60+ products. 582 are rated high or critical, and none are known to be exploited. The most recent was published on October 27, 2026.
Latest NVIDIA vulnerabilities
- 8.5 High severity
Container Toolkit: Improper Link Resolution Before File Access
NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook, where an attacker could cause a link following by using a specially crafted container image. A successful exploit of this vulnerability might lead to data tampering
- 9.0 Critical severity
Container Toolkit: Untrusted Search Path
NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could execute arbitrary code with elevated permissions. A successful exploit of this vulnerability might lead to escalation of
- 7.6 High severity
DOCA-Host and Mellanox OFED: Incorrect Execution-Assigned Permissions
NVIDIA DOCA-Host and Mellanox OFED contain a vulnerability in the VGT+ feature, where an attacker on a VM might cause escalation of privileges and denial of service on the VLAN.
- 7.8 High severity
Megatron LM: Improper Control of Generation of Code
NVIDIA Megatron-LM for all platforms contains a vulnerability in a python component where an attacker may cause a code injection issue by providing a malicious file. A successful exploit of this vulnerability may lead to Code Execution, Escalation of Privilege
- 7.8 High severity
Megatron LM: Improper Control of Generation of Code
NVIDIA Megatron-LM for all platforms contains a vulnerability in a python component where an attacker may cause a code injection issue by providing a malicious file. A successful exploit of this vulnerability may lead to Code Execution, Escalation of Privilege
- 7.5 High severity
NVDebug tool: Internal Asset Exposed to Unsafe Debug Access Level or State
The NVIDIA NVDebug tool contains a vulnerability that may allow an actor to gain access to restricted components. A successful exploit of this vulnerability may lead to information disclosure.
- 7.8 High severity
NVIDIA CUDA Toolkit: Improper Handling of Length Parameter Inconsistency
NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a failure to check the length of a buffer could allow a user to cause the tool to crash or execute arbitrary code by passing in a malformed ELF file. A successful exp
- 8.8 High severity
TensorRT-LLM: Deserialization of Untrusted Data
NVIDIA TensorRT-LLM for any platform contains a vulnerability in python executor where an attacker may cause a data validation issue by local access to the TRTLLM server. A successful exploit of this vulnerability may lead to code execution, information disclo
- 7.8 High severity
GPU Display Driver, vGPU Software, Cloud Gaming: Incorrect Authorization
NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an unprivileged attacker to escalate permissions. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information d
- 9.8 Critical severity
NeMo Framework: Improper Control of Generation of Code
NVIDIA NeMo Framework contains a vulnerability where a user could cause an improper control of generation of code by remote code execution. A successful exploit of this vulnerability might lead to code execution and data tampering.
- 9.8 Critical severity
NeMo Framework: Improper Limitation of a Pathname to a Restricted Directory
NVIDIA NeMo Framework contains a vulnerability where an attacker could cause an improper limitation of a pathname to a restricted directory by an arbitrary file write. A successful exploit of this vulnerability might lead to code execution and data tampering.
- 9.8 Critical severity
NeMo Framework: Deserialization of Untrusted Data
NVIDIA NeMo Framework contains a vulnerability where a user could cause a deserialization of untrusted data by remote code execution. A successful exploit of this vulnerability might lead to code execution and data tampering.
- 9.8 Critical severity
NeMo Framework: Relative Path Traversal
NVIDIA Nemo Framework contains a vulnerability where a user could cause a relative path traversal issue by arbitrary file write. A successful exploit of this vulnerability may lead to code execution and data tampering.
- 9.1 Critical severity
Riva: Improper Access Control
NVIDIA Riva contains a vulnerability where a user could cause an improper access control issue. A successful exploit of this vulnerability might lead to data tampering or denial of service.
- 9.8 Critical severity
Riva: Improper Access Control
NVIDIA Riva contains a vulnerability where a user could cause an improper access control issue. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, denial of service, or information disclosure.
- 8.1 High severity
NVIDIA Hopper HGX 8-GPU: Internal Asset Exposed to Unsafe Debug Access Level or State
NVIDIA Hopper HGX for 8-GPU contains a vulnerability in the HGX Management Controller (HMC) that may allow a malicious actor with administrative access on the BMC to access the HMC as an administrator. A successful exploit of this vulnerability may lead to cod
- 7.6 High severity
IGX Orin: Unimplemented or Unsupported Feature in UI
NVIDIA Jetson Linux and IGX OS image contains a vulnerability in the UEFI firmware RCM boot mode, where an unprivileged attacker with physical access to the device could load untrusted code. A successful exploit might lead to code execution, escalation of priv
- 8.1 High severity
Container Toolkit: Time-of-check Time-of-use (TOCTOU) Race Condition
NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability when used with default configuration, where a crafted container image could gain access to the host file system. A successful exploit of this vulnerability might lea
- 7.5 High severity
NVIDIA Jetson AGX Orin™ and NVIDIA IGX Orin software contain a vulnerability where an attacker…
NVIDIA Jetson AGX Orin™ and NVIDIA IGX Orin software contain a vulnerability where an attacker can cause an improper input validation issue by escalating certain permissions to a limited degree. A successful exploit of this vulnerability might lead to code exe
- 7.1 High severity
NVIDIA GPU Display Driver, vGPU software: Out-of-bounds Write
NVIDIA GPU display driver for Windows and Linux contains a vulnerability where data is written past the end or before the beginning of a buffer. A successful exploit of this vulnerability might lead to information disclosure, denial of service, or data tamperi
- 7.8 High severity
NVIDIA vGPU software: Buffer Copy without Checking Size of Input
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause memory corruption. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, or data tamperi
- 8.4 High severity
NVIDIA Container Toolkit: Improper Isolation or Compartmentalization
NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code obtaining read and write access to host devices. This vulnerability is present only when the NVIDIA Container Toolkit i
- 7.6 High severity
NVIDIA Container Toolkit: Improper Isolation or Compartmentalization
NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to modification of a host binary. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of
- 8.8 High severity
UFM Enterprise GA: Improper Authentication
NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI contain a vulnerability where an attacker can cause an improper authentication issue by sending a malformed request through the Ethernet management interface. A successful exploit of this vulnerability migh
- 9.8 Critical severity
Base Command Manager: Missing Authorization
NVIDIA Base Command Manager contains a missing authentication vulnerability in the CMDaemon component. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tamper
- 7.6 High severity
DLS component of NVIDIA License System: Missing Authorization
NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an attacker may cause an unauthorized action. A successful exploit of this vulnerability may lead to partial denial of service and confidential information disclosure
- 8.7 High severity
BlueField 1: Improper Handling of Insufficient Privileges
NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit (DPU) contains a vulnerability where an attacker may cause an improper handling of insufficient privileges issue. A successful exploit of this vulnerability may lead to denial of service, dat
- 8.9 High severity
ConnectX4: Improper Handling of Insufficient Privileges
NVIDIA ConnectX Firmware contains a vulnerability where an attacker may cause an improper handling of insufficient privileges issue. A successful exploit of this vulnerability may lead to denial of service, data tampering, and limited information disclosure.
- 7.1 High severity
vGPU and Cloud Gaming: Incorrect Permission Assignment for Critical Resource
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager that allows a user of the guest OS to access global resources. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and escalation of privilege
- 7.8 High severity
NVIDIA vGPU software contains a vulnerability in the GPU kernel driver of the vGPU Manager for…
NVIDIA vGPU software contains a vulnerability in the GPU kernel driver of the vGPU Manager for all supported hypervisors, where a user of the guest OS can cause an improper input validation by compromising the guest OS kernel. A successful exploit of this vuln
- 8.2 High severity
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability which could allow a…
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability which could allow a privileged attacker to escalate permissions. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, info
- 7.8 High severity
GPU, vGPU, and Cloud Gaming: Out-of-bounds Read
NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of
- 7.8 High severity
GPU, vGPU, and Cloud Gaming: Out-of-bounds Read
NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of
- 7.8 High severity
GPU, vGPU, and Cloud Gaming: Out-of-bounds Read
NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of
- 7.8 High severity
GPU, vGPU, and Cloud Gaming: Out-of-bounds Read
NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of
- 7.8 High severity
GPU, vGPU, and Cloud Gaming: Out-of-bounds Read
NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of
- 7.8 High severity
NeMo: Improper Limitation of a Pathname to a Restricted Directory
NVIDIA NeMo contains a vulnerability in SaveRestoreConnector where a user may cause a path traversal issue via an unsafe .tar file extraction. A successful exploit of this vulnerability may lead to code execution and data tampering.
- 8.3 High severity
Container Toolkit: Time-of-check Time-of-use (TOCTOU) Race Condition
NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases whe
- 7.8 High severity
CUDA Toolkit: Out-of-bounds Write
NVIDIA CUDA Toolkit contains a vulnerability in command `cuobjdump` where a user may cause an out-of-bound write by passing in a malformed ELF file. A successful exploit of this vulnerability may lead to code execution or denial of service.
- 8.8 High severity
Mellanox OS: Improper Limitation of a Pathname to a Restricted Directory
NVIDIA Mellanox OS, ONYX, Skyway, and MetroX-3 XCC contain a vulnerability in the web support, where an attacker can cause a CGI path traversal by a specially crafted URI. A successful exploit of this vulnerability might lead to escalation of privileges and in