NVIDIA vulnerabilities
We track 582 vulnerabilities in NVIDIA products across 60+ products. 582 are rated high or critical, and none are known to be exploited. The most recent was published on October 27, 2026.
Latest NVIDIA vulnerabilities
- 7.1 High severity
DCGM: Out-of-bounds Write
NVIDIA DCGM for Linux contains a vulnerability in HostEngine (server component) where a user may cause a heap-based buffer overflow through the bound socket. A successful exploit of this vulnerability may lead to denial of service and data tampering.
- 7.8 High severity
GeForce Experience: Improper Link Resolution Before File Access
NVIDIA GeForce Experience contains a vulnerability in the NVContainer component, where a user without administrator privileges can create a symbolic link to a file that requires elevated privileges to write to or modify, which may lead to denial of service, es
- 7.3 High severity
GeForce Experience: Uncontrolled Search Path Element
NVIDIA GeForce Experience contains an uncontrolled search path vulnerability in all its client installers, where an attacker with user level privileges may cause the installer to load an arbitrary DLL when the installer is launched. A successful exploit of thi
- 7.8 High severity
Omniverse Audio2Face: Improper Control of Generation of Code
Omniverse Kit contains a vulnerability in the reference applications Create, Audio2Face, Isaac Sim, View, Code, and Machinima. These applications allow executable Python code to be embedded in Universal Scene Description (USD) files to customize all aspects of
- 8.8 High severity
NVIDIA DGX servers: Improper Neutralization of Special Elements used in an OS Command
NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure and data tampering.
- 8.8 High severity
NVIDIA DGX servers: Improper Neutralization of Special Elements used in an OS Command
NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure and data tampering.
- 7.8 High severity
NVIDIA DGX servers: Unrestricted Upload of File with Dangerous Type
NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can upload and download arbitrary files under certain circumstances, which may lead to denial of service, escalation of privileges, information disclosure and data tampering.
- 7.8 High severity
NVIDIA DGX servers: Improper Prevention of Lock Bit Modification
DGX A100 SBIOS contains a vulnerability in the Pre-EFI Initialization (PEI)phase, where a privileged user can disable SPI flash protection, which may lead to denial of service, escalation of privileges, or data tampering.
- 7.8 High severity
NVIDIA DGX servers: Buffer Copy without Checking Size of Input
NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow and cause a denial of service or gain code execution.
- 7.8 High severity
NVIDIA DGX servers: Improper Limitation of a Pathname to a Restricted Directory
NVIDIA BMC contains a vulnerability in SPX REST auth handler, where an un-authorized attacker can exploit a path traversal, which may lead to authentication bypass.
- 8.8 High severity
NVIDIA DGX servers: Improper Neutralization of Special Elements used in an OS Command
NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure and data tampering.
- 7.8 High severity
NVIDIA DGX servers: Improper Restriction of Operations within the Bounds of a Memory Buffer
NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can read and write to arbitrary locations within the memory context of the IPMI server process, which may lead to code execution, denial of service, information disclosure and da
- 8.2 High severity
NVIDIA DGX servers: Missing Authentication for Critical Functionality
NVIDIA DGX Station contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The sc
- 8.2 High severity
NVIDIA DGX servers: Missing Authentication for Critical Functionality
NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The scope
- 7.1 High severity
NVIDIA DGX servers: Missing Authentication for Critical Functionality
NVIDIA BMC IPMI handler allows an unauthenticated host to write to a host SPI flash bypassing secureboot protections. This may lead to a loss of integrity and denial of service.
- 7.8 High severity
NVIDIA DGX servers: Buffer Copy without Checking Size of Input
NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow and cause a denial of service or gain code execution.
- 8.8 High severity
NVIDIA DGX servers: Buffer Copy without Checking Size of Input
NVIDIA BMC contains a vulnerability in libwebsocket, where an authorized attacker can cause a buffer overflow and cause a denial of service or gain code execution.
- 8.8 High severity
NVIDIA DGX servers: Buffer Copy without Checking Size of Input
NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow, which may lead to code execution, denial of service or escalation of privileges.
- 7.8 High severity
NVIDIA DGX Servers: Buffer Copy without Checking Size of Input
NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow and cause a denial of service or gain code execution
- 7.8 High severity
NVIDIA Jetson AGX Xavier Series, Jetson Xavier…: Out-of-bounds Write
NVIDIA distributions of Linux contain a vulnerability in nvdla_emu_task_submit, where unvalidated input may allow a local attacker to cause stack-based buffer overflow in kernel code, which may lead to escalation of privileges, compromised integrity and confid
- 7.9 High severity
NVIDIA Trusted OS contains a vulnerability in an SMC call handler, where failure to validate…
NVIDIA Trusted OS contains a vulnerability in an SMC call handler, where failure to validate untrusted input may allow a highly privileged local attacker to cause information disclosure and compromise integrity. The scope of the impact can extend to other comp
- 7.8 High severity
NVIDIA GPU Display Driver for Windows: Out-of-bounds Read
NVIDIA GPU Display Driver for Windows contains a vulnerability where a regular user can cause an out-of-bounds read, which may lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.
- 7.1 High severity
NVIDIA GPU Display Driver for Linux: Integer Overflow or Wraparound
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow may lead to information disclosure or data tampering.
- 7.8 High severity
vGPU software (guest driver) - Linux, vGPU…: Improper Restriction of Operations within the Bounds of a Memory Buffer
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause the use of an out-of-range pointer offset, which may lead to data tampering, data loss, information disclosure, or denial of ser
- 7.1 High severity
vGPU software (guest driver) - Linux, vGPU…: Integer Overflow or Wraparound
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an Integer overflow may lead to denial of service or information disclosure.
- 7.8 High severity
vGPU software (Virtual GPU Manager), NVIDIA…: Buffer Copy without Checking Size of Input
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where an input index is not validated, which may lead to buffer overrun, which in turn may cause data tampering, information disclosure, or denial of service.
- 7.8 High severity
vGPU software (Virtual GPU Manager), NVIDIA…: Buffer Copy without Checking Size of Input
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where an input index is not validated, which may lead to buffer overrun, which in turn may cause data tampering, information disclosure, or denial of service.
- 7.8 High severity
vGPU software (guest driver) - Linux, NVIDIA…: Improper Preservation of Permissions
NVIDIA vGPU Display Driver for Linux guest contains a vulnerability in a D-Bus configuration file, where an unauthorized user in the guest VM can impact protected D-Bus endpoints, which may lead to code execution, denial of service, escalation of privileges, i
- 7.3 High severity
vGPU software (guest driver) - Linux, vGPU…: Integer Overflow or Wraparound
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow may lead to denial of service, data tampering, or information disclosure.
- 7.3 High severity
vGPU software (guest driver) - Linux, vGPU…: Integer Overflow or Wraparound
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow may lead to information disclosure, data tampering or denial of service.
- 7.8 High severity
vGPU software (guest driver) - Linux, vGPU…: Integer Overflow or Wraparound
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow in index validation may lead to denial of service, information disclosure, or data tampering.
- 7.8 High severity
vGPU software (guest driver) - Linux, vGPU…: Improper Validation of Array Index
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an out-of-bounds array access may lead to denial of service, information disclosure, or data tampering.
- 7.8 High severity
vGPU software (guest driver) - Linux, vGPU…: Improper Validation of Array Index
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an out-of-bounds array access may lead to denial of service, data tampering, or information disclosure.
- 7.1 High severity
vGPU software (guest driver) - Linux, vGPU…: Off-by-one Error
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an off-by-one error may lead to data tampering or information disclosure.
- 7.1 High severity
vGPU software (guest driver) - Linux, vGPU…: Incorrect Conversion between Numeric Types
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unprivileged regular user can cause an integer to be truncated, which may lead to denial of service or data tampering.
- 7.8 High severity
vGPU software (guest driver) - Linux, vGPU…: Out-of-bounds Read
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an out-of-bounds read may lead to denial of service, information disclosure, or data tampering.
- 7.3 High severity
NVIDIA GPU Display Driver for Linux: Out-of-bounds Read
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an out-of-bounds array access may lead to denial of service, information disclosure, or data tampering.
- 7.8 High severity
vGPU software (guest driver) - Windows, NVIDIA…: Improper Access Control
NVIDIA Control Panel for Windows contains a vulnerability where an unauthorized user or an unprivileged regular user can compromise the security of the software by gaining privileges, reading sensitive information, or executing commands.
- 8.8 High severity
NVIDIA GPU Display Driver for Windows: Out-of-bounds Write
NVIDIA GPU Display Driver for Windows contains a vulnerability in the user-mode layer, where an unprivileged user can cause an out-of-bounds write, which may lead to code execution, information disclosure, and denial of service.
- 7.8 High severity
vGPU software (guest driver) - Linux, vGPU…: Incorrect Conversion between Numeric Types
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unprivileged regular user can cause truncation errors when casting a primitive to a primitive of smaller size causes data to be lost in the conversion, whic