CVE-2025-23350
Received Received - Intake

Command Interface Write Out of Bounds in NVIDIA ConnectX and BlueField

Publication date: 2026-07-01

Last updated on: 2026-07-01

Assigner: NVIDIA Corporation

Description
NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bounds by crafted input. A successful exploit of this vulnerability may lead to arbitrary code execution on the device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-01
Last Modified
2026-07-01
Generated
2026-07-01
AI Q&A
2026-07-01
EPSS Evaluated
N/A
NVD
CVE-2025-23350
EUVD
EUVD-2025-210395

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nvidia bluefield to 46.3008 (exc)
nvidia connectx to 43.8002 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in NVIDIA ConnectX and BlueField products within their command interface.

A local user who has virtual function (VF) access can exploit this flaw by providing specially crafted input that causes a write operation outside the intended memory bounds (out-of-bounds write).

If successfully exploited, this vulnerability may allow the attacker to execute arbitrary code on the affected device.

Impact Analysis

The impact of this vulnerability is critical, as it can lead to arbitrary code execution on the device.

This means an attacker with local VF access could potentially take control of the device, compromise its integrity, and perform unauthorized actions.

The CVSS v3.1 base score of 9.0 reflects high severity, indicating significant confidentiality, integrity, and availability impacts.

Mitigation Strategies

To mitigate this vulnerability, it is recommended to update affected NVIDIA BlueField and ConnectX products to the fixed versions provided by NVIDIA. The vulnerability affects various releases prior to specific update versions such as 46.3008, 35.8002, 39.8002, and 43.8002.

Consult the NVIDIA security bulletin and official advisories for detailed mitigation instructions and apply patches or firmware updates as soon as possible to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-23350. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart