CVE-2025-23253

April 22, 2025, 7:15 p.m.

2.5
Low

Description

NVIDIA NvContainer service for Windows contains a vulnerability in its usage of OpenSSL, where an attacker could exploit a hard-coded constant issue by copying a malicious DLL in a hard-coded path. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.

Product(s) Impacted

Vendor Product Versions
Nvidia
  • Nvcontainer
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-547
Use of Hard-coded, Security-relevant Constants
The product uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or security policy change.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a nvidia nvcontainer / / / / / / / /

References

https://nvidia.custhelp.com/app/answers/detail/a_id/5644

Tags

psirt@nvidia.com
CWE-547
2025-04-22
CVE-2025-23253

CVSS Score

2.5 / 10

CVSS Data - 3.1

  • Attack Vector: LOCAL
  • Attack Complexity: HIGH
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: LOW

    • CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

    View Vector String

Timeline

Published: April 22, 2025, 7:15 p.m.
Last Modified: April 22, 2025, 7:15 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

psirt@nvidia.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.