CVE-2025-23350: NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of…

PriorityP353critical9CVSS 3.1

AVAACLPRLUINSCCHIHAH

EPSS

0.37%

30.2th percentile

NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bounds by crafted input. A successful exploit of this vulnerability may lead to arbitrary code execution on the device.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
nvidia	bluefield_ga	—	—
nvidia	bluefield_lts22	—	—
nvidia	bluefield_lts23	—	—
nvidia	bluefield_lts24	—	—
nvidia	connectx_ga	—	—
nvidia	connectx_lts22	—	—
nvidia	connectx_lts23	—	—
nvidia	connectx_lts24	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.