CVE-2025-23351 - Vulnerability Details - OpenCVE

NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bounds by crafted input. A successful exploit of this vulnerability may lead to arbitrary code execution on the device.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

No data.

References

Link	Providers
https://github.com/NVIDIA/product-security/tree/main/2026/5699
https://nvd.nist.gov/vuln/detail/CVE-2025-23351
https://www.cve.org/CVERecord?id=CVE-2025-23351

History

Wed, 01 Jul 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 01 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bounds by crafted input. A successful exploit of this vulnerability may lead to arbitrary code execution on the device.
Weaknesses		CWE-787
References		https://github.com/NVIDIA/product-security/tree/main/2026/5699 https://nvd.nist.gov/vuln/detail/CVE-2025-23351 https://www.cve.org/CVERecord?id=CVE-2025-23351
Metrics		cvssV3_1 `{'score': 9, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: nvidia

Published: 2026-07-01T14:39:03.200Z

Updated: 2026-07-01T16:03:10.537Z

Reserved: 2025-01-14T01:07:21.737Z

Link: CVE-2025-23351

Vulnrichment

Updated: 2026-07-01T16:03:06.715Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-23351", "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "state": "PUBLISHED", "assignerShortName": "nvidia", "dateReserved": "2025-01-14T01:07:21.737Z", "datePublished": "2026-07-01T14:39:03.200Z", "dateUpdated": "2026-07-01T16:03:10.537Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "shortName": "nvidia", "dateUpdated": "2026-07-01T14:39:03.200Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Code execution"}]}], "affected": [{"vendor": "NVIDIA", "product": "BlueField GA", "platforms": ["BlueField-2(46)", "BlueField-3(46)"], "versions": [{"status": "affected", "version": "All versions prior to 46.3008"}], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "BlueField LTS22", "platforms": ["BlueField-2(35)"], "versions": [{"status": "affected", "version": "All versions prior to 35.8002"}], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "BlueField LTS23", "platforms": ["BlueField-2(39)", "BlueField-3(39)"], "versions": [{"status": "affected", "version": "All versions prior to 39.8002"}], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "BlueField LTS24", "platforms": ["BlueField-2(43)", "BlueField-3(43)"], "versions": [{"status": "affected", "version": "All versions prior to 43.8002"}], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "ConnectX GA", "platforms": ["ConnectX-6 DE", "ConnectX-6 DX", "ConnectX-6 LX", "ConnectX-7", "ConnectX-8"], "versions": [{"status": "affected", "version": "All versions prior to 46.3008"}], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "ConnectX LTS22", "platforms": ["ConnectX-5*", "ConnectX-6*", "ConnectX-6 DE", "ConnectX-6 DX", "ConnectX-6 LX", "ConnectX-7"], "versions": [{"status": "affected", "version": "All versions prior to 35.8002"}], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "ConnectX LTS23", "platforms": ["ConnectX-6*", "ConnectX-6 DE", "ConnectX-6 DX", "ConnectX-6 LX", "ConnectX-7"], "versions": [{"status": "affected", "version": "All versions prior to 39.8002"}], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "ConnectX LTS24", "platforms": ["ConnectX-6*", "ConnectX-6 DE", "ConnectX-6 DX", "ConnectX-6 LX", "ConnectX-7"], "versions": [{"status": "affected", "version": "All versions prior to 43.8002"}], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "ConnectX-4", "platforms": ["N/A(28)"], "versions": [{"status": "affected", "version": "All versions prior to 28.4702"}], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "ConnectX-4 LX", "platforms": ["N/A(32)"], "versions": [{"status": "affected", "version": "All versions prior to 32.1908"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bounds by crafted input. A successful exploit of this vulnerability may lead to arbitrary code execution on the device.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bounds by crafted input. A successful exploit of this vulnerability may lead to arbitrary code execution on the device."}]}], "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23351"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-23351"}, {"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5699"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "NVIDIA PSIRT"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-01T16:03:00.538625Z", "id": "CVE-2025-23351", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-01T16:03:10.537Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-23351", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-01T16:03:00.538625Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-01T16:03:06.715Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "impacts": [{"descriptions": [{"lang": "en", "value": "Code execution"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NVIDIA", "product": "BlueField GA", "versions": [{"status": "affected", "version": "All versions prior to 46.3008"}], "platforms": ["BlueField-2(46)", "BlueField-3(46)"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "BlueField LTS22", "versions": [{"status": "affected", "version": "All versions prior to 35.8002"}], "platforms": ["BlueField-2(35)"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "BlueField LTS23", "versions": [{"status": "affected", "version": "All versions prior to 39.8002"}], "platforms": ["BlueField-2(39)", "BlueField-3(39)"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "BlueField LTS24", "versions": [{"status": "affected", "version": "All versions prior to 43.8002"}], "platforms": ["BlueField-2(43)", "BlueField-3(43)"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "ConnectX GA", "versions": [{"status": "affected", "version": "All versions prior to 46.3008"}], "platforms": ["ConnectX-6 DE", "ConnectX-6 DX", "ConnectX-6 LX", "ConnectX-7", "ConnectX-8"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "ConnectX LTS22", "versions": [{"status": "affected", "version": "All versions prior to 35.8002"}], "platforms": ["ConnectX-5*", "ConnectX-6*", "ConnectX-6 DE", "ConnectX-6 DX", "ConnectX-6 LX", "ConnectX-7"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "ConnectX LTS23", "versions": [{"status": "affected", "version": "All versions prior to 39.8002"}], "platforms": ["ConnectX-6*", "ConnectX-6 DE", "ConnectX-6 DX", "ConnectX-6 LX", "ConnectX-7"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "ConnectX LTS24", "versions": [{"status": "affected", "version": "All versions prior to 43.8002"}], "platforms": ["ConnectX-6*", "ConnectX-6 DE", "ConnectX-6 DX", "ConnectX-6 LX", "ConnectX-7"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "ConnectX-4", "versions": [{"status": "affected", "version": "All versions prior to 28.4702"}], "platforms": ["N/A(28)"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "ConnectX-4 LX", "versions": [{"status": "affected", "version": "All versions prior to 32.1908"}], "platforms": ["N/A(32)"], "defaultStatus": "unaffected"}], "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23351"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-23351"}, {"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5699"}], "x_generator": {"engine": "NVIDIA PSIRT"}, "descriptions": [{"lang": "en", "value": "NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bounds by crafted input. A successful exploit of this vulnerability may lead to arbitrary code execution on the device.", "supportingMedia": [{"type": "text/html", "value": "NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bounds by crafted input. A successful exploit of this vulnerability may lead to arbitrary code execution on the device.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "shortName": "nvidia", "dateUpdated": "2026-07-01T14:39:03.200Z"}}}, "cveMetadata": {"cveId": "CVE-2025-23351", "state": "PUBLISHED", "dateUpdated": "2026-07-01T16:03:10.537Z", "dateReserved": "2025-01-14T01:07:21.737Z", "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "datePublished": "2026-07-01T14:39:03.200Z", "assignerShortName": "nvidia"}, "dataVersion": "5.2"}