Introduction
On unpatched systems, attackers can use the NVIDIA Installer for Windows to gain administrator privileges, execute arbitrary code, or tamper with system data. The vulnerability affects a wide range of NVIDIA GPU drivers, so it matters to any organization or user running NVIDIA hardware on Windows.
NVIDIA is a global leader in graphics processing technology, and its products run gaming, professional visualization, AI, and data center workloads. Its drivers are deployed on millions of systems worldwide, which makes a vulnerability in this ecosystem highly significant for both enterprise and consumer environments.
Technical information
CVE-2025-23276 is a privilege escalation vulnerability in the NVIDIA Installer for Windows. The root cause is improper access control over files or directories during installation or update, classified as CWE-552 (Files or Directories Accessible to External Parties).
When the installer runs, it creates or modifies files and directories with permissions that are too broad. Because the process runs with elevated privileges, a local attacker can plant malicious files or manipulate installer-created resources while it runs. The result can be privilege escalation, arbitrary code execution, information disclosure, data tampering, or denial of service.
The vulnerability is exploitable only locally and does not allow remote code execution by itself. No public code or exploit samples are available for this issue.
Patch information
NVIDIA fixed CVE-2025-23276 in its July 2025 security update. The fixed versions are:
- R575 driver series: Update to 577.00 or later
- R570 driver series: Update to 573.48 or later
- R535 driver series: Update to 539.41 or later
- vGPU software: Update to vGPU 18.4 (573.48) or 16.11 (539.41) or later
All users and administrators should upgrade to these versions or newer. Updates are available through the NVIDIA Security Bulletin and the official driver download portals. For more detail and a list of every vulnerability fixed in this update, see SecurityOnline.info.
Affected systems and versions
- NVIDIA GPU Display Driver for Windows (GeForce, Quadro, NVS, Tesla):
- R575: All versions before 577.00
- R570: All versions before 573.48
- R535: All versions before 539.41
- NVIDIA vGPU Software:
- All versions prior to 18.4 (573.48) and 16.11 (539.41) across Windows, Linux, Citrix, VMware, and Azure Stack HCI
A system running any of these versions is vulnerable if the NVIDIA Installer for Windows is used on it.
Vendor security history
NVIDIA regularly discloses and patches vulnerabilities in its GPU drivers and vGPU software. In recent years these have included privilege escalation flaws, container escape vulnerabilities (such as CVE-2025-23266 "NVIDIAScape"), and improper access control issues. The company usually publishes coordinated security bulletins that cover several issues at once. That habit reflects a mature vulnerability management process, and also how complex NVIDIA's driver ecosystem is.
