CVE-2025-23347
BaseFortify
Publication date: 2025-10-23
Last updated on: 2025-10-27
Assigner: NVIDIA Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nvidia | project_g_assist | * |
| nvidia | cloud_gaming | * |
| nvidia | vgpu | * |
| nvidia | display_driver | * |
| nvidia | linux_kernel_driver | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-276 | During installation, installed file permissions are set to allow anyone to modify those files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-23347 is a vulnerability in NVIDIA's Project G-Assist that allows an attacker with local access and low privileges to escalate their permissions. This flaw is due to incorrect default permissions (CWE-276). Exploiting it can lead to code execution, privilege escalation, data tampering, denial of service, and information disclosure without requiring user interaction. [2]
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized code execution, escalation of privileges allowing attackers to gain higher access than intended, tampering with data, causing denial of service, and disclosing sensitive information. These impacts can compromise system confidentiality, integrity, and availability. [2]