Skip to content
OpenAdvisories
Critical · 9.0 Public exploit CVE-2025-23266 EUVD-2025-21811GHSA-vmg3-7v43-9g23GO-2025-3992

NVIDIA Container Toolkit for all platforms contains an Untrusted Search Path

Published Jul 17, 2025 · Updated Feb 26, 2026 · Assigned by nvidia

Vendor: NVIDIA Product: Container Toolkit Package: github.com/NVIDIA/gpu-operator Package: github.com/NVIDIA/k8s-device-plugin Package: github.com/NVIDIA/mig-parted Package: github.com/NVIDIA/nvidia-container-toolkit Package: nvidia-container-toolkit Package: nvidia-container-toolkit Ecosystem: Azure Linux Ecosystem: Go Ecosystem: Wolfi

Description

NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could execute arbitrary code with elevated permissions. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, information disclosure, and denial of service.

Affected products

VendorProductAffectedFixed
NVIDIA Container Toolkit NVIDIA Container Toolkit All versions up to and including 1.17.7 (CDI mode only for versions prior to 1.17.5), NVIDIA GPU Operator All versions up to and including 25.3.0 (CDI mode only for versions prior to 25.3.0) —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 toolbox +1 0.2-1.el10_0 RHSA-2025:13674
RHEL 9 toolbox +1 0.2-1.el9_6 RHSA-2025:13673

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 toolbox +1 0.2-1.el10_0 ALSA-2025:13674
AlmaLinux 9 toolbox +1 0.2-1.el9_6 ALSA-2025:13673

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 nvidia-container-toolkit 1.18.0-150200.5.17.1 SUSE-SU-2025:4187-1
SLES 15 SP6 govulncheck-vulndb 0.0.20251023T162509-150000.1.110.1 SUSE-SU-2025:3799-1
SLES 15 SP6 nvidia-container-toolkit 1.18.0-150200.5.17.1 SUSE-SU-2025:4187-1
SLES 15 SP5 nvidia-container-toolkit 1.18.0-150200.5.17.1 SUSE-SU-2025:4187-1
SLES 15 SP4 nvidia-container-toolkit 1.18.0-150200.5.17.1 SUSE-SU-2025:4187-1
SLES 15 SP3 nvidia-container-toolkit 1.18.0-150200.5.17.1 SUSE-SU-2025:4187-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP5 nvidia-container-toolkit 1.18.0-150200.5.17.1 SUSE-SU-2025:4187-1
SLES for SAP 15 SP4 nvidia-container-toolkit 1.18.0-150200.5.17.1 SUSE-SU-2025:4187-1
SLES for SAP 15 SP3 nvidia-container-toolkit 1.18.0-150200.5.17.1 SUSE-SU-2025:4187-1
SLE HPC 15 SP5 nvidia-container-toolkit 1.18.0-150200.5.17.1 SUSE-SU-2025:4187-1
SLE HPC 15 SP4 nvidia-container-toolkit 1.18.0-150200.5.17.1 SUSE-SU-2025:4187-1
SLE HPC 15 SP3 nvidia-container-toolkit 1.18.0-150200.5.17.1 SUSE-SU-2025:4187-1
SUSE Enterprise Storage 7.1 nvidia-container-toolkit 1.18.0-150200.5.17.1 SUSE-SU-2025:4187-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed govulncheck-vulndb 0.0.20251023T162509-1.1 openSUSE-SU-2025:15666-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20251023T162509-150000.1.110.1 SUSE-SU-2025:3799-1
openSUSE Leap 15.6 nvidia-container-toolkit 1.18.0-150200.5.17.1 SUSE-SU-2025:4187-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 nvidia-container-toolkit 1.17.8-1 —
Azure Linux 2 (CBL-Mariner) nvidia-container-toolkit 1.17.8-1 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling nvidia-container-toolkit 1.17.8-r0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 5 repositories

  • jpts/cve-2025-23266-poc ★ 15 · Jul 19, 2025

    PoC for NVIDIAScape bug

  • mrk336/CVE-2025-23266 ★ 2 · Sep 7, 2025

    CVE-2025-23266 targets FastAPI’s parse_request() function, where oversized HTTP headers cause a buffer overflow and remote code execution. The article explains how attackers can escape container boun…

  • Mindasy/cve-2025-23266-migration-bypass ★ 1 · Sep 4, 2025

    cve-2025-23266-migration-bypass

  • r0binak/CVE-2025-23266 ★ 1 · Sep 2, 2025

    CVE-2025-23266 – Fully Weaponized NVIDIA Container Toolkit Exploit

  • CR1MS0N-Operator/security-research ★ 0 · Jan 10, 2026

    Original offensive security research into Linux container boundary weaknesses. Whitepaper 1: OCI hook isolation failures in the NVIDIA Container Toolkit (CVE-2025-23266) under rootless Podman — four-…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/NVIDIA/gpu-operator < 25.3.2 25.3.2 GHSA-vmg3-7v43-9g23
Go github.com/NVIDIA/gpu-operator all versions — GO-2025-3992
Go github.com/NVIDIA/k8s-device-plugin < 0.17.3 0.17.3 GHSA-vmg3-7v43-9g23
Go github.com/NVIDIA/mig-parted < 0.12.2 0.12.2 GHSA-vmg3-7v43-9g23
Go github.com/NVIDIA/nvidia-container-toolkit < 1.17.8 1.17.8 GHSA-vmg3-7v43-9g23

Advisories 9

References