Introduction
A single vulnerable virtual machine can put the security of an entire GPU-accelerated data center at risk. CVE-2025-23283, a stack buffer overflow in NVIDIA's vGPU software for Linux-style hypervisors, could let a malicious guest execute code or escalate privileges on the host. It matters most to organizations that run multi-tenant environments with shared GPUs, such as cloud providers and enterprises with virtual desktop infrastructure (VDI).
About NVIDIA and vGPU: NVIDIA dominates GPU hardware and virtualization, and its products run AI, graphics, and compute workloads worldwide. Its vGPU platform lets multiple virtual machines share one physical GPU, and modern cloud, research, and enterprise environments are built on it. vGPU has millions of deployments and integrates with the major hypervisors, so a vulnerability in this stack reaches a large number of real systems.
Technical information
CVE-2025-23283 is a stack-based buffer overflow (CWE-121) in the Virtual GPU Manager component of NVIDIA vGPU software for Linux-style hypervisors. A guest VM triggers it by sending crafted input that the Virtual GPU Manager does not bounds-check properly. The attacker can then overwrite stack memory and possibly corrupt return addresses or function pointers.
- The Virtual GPU Manager, where the flaw sits, runs with elevated privileges on the hypervisor host.
- A guest VM with low privileges can exploit it, and no user interaction is required.
- Attack complexity is low. An attacker can trigger the overflow with specially crafted GPU operation requests or malformed command buffers.
- Successful exploitation can lead to arbitrary code execution, privilege escalation, denial of service, information disclosure, or data tampering on the host.
- The vulnerability affects the isolation boundary between guest and host, which multi-tenant and cloud environments depend on.
The referenced materials include no public code snippets or detailed exploit code.
Patch information
NVIDIA has released security updates for CVE-2025-23283 and related vulnerabilities. Install the following versions to reduce the risk:
Windows drivers:
- GeForce: 577.00
- NVIDIA RTX, Quadro, NVS: 573.48
- Tesla: 573.48
Linux drivers:
- GeForce: 575.64.05
- NVIDIA RTX, Quadro, NVS: 575.64.05
- Tesla: 570.172.08
vGPU software:
- Guest Driver (Windows): 573.48
- Guest Driver (Linux): 570.172.08
- Virtual GPU Manager: 570.172.07
Download updates from the NVIDIA Driver Downloads page and the NVIDIA Licensing Portal.
Detection methods
Tenable's Nessus detects CVE-2025-23283 (Plugin ID 243281). Recommended steps:
- Scan with Nessus or a similar tool to find vulnerable NVIDIA vGPU installations.
- Watch guest VMs for abnormal activity, such as unexpected crashes or memory spikes.
- Review system and application logs regularly for anomalies.
- Make sure your IDS has the latest signatures for NVIDIA vGPU vulnerabilities.
- Run regular security audits and penetration tests to check how well your detection works.
Reference: Nessus Plugin 243281
Affected systems and versions
The vulnerability affects NVIDIA vGPU for Linux-style hypervisors, including Citrix Hypervisor, Linux with KVM, Red Hat Enterprise Linux with KVM, Ubuntu, and VMware vSphere. Vulnerable versions:
- Virtual GPU Manager versions prior to 570.172.07
- Guest Driver (Linux) versions prior to 570.172.08
- Guest Driver (Windows) versions prior to 573.48
- GeForce (Windows) versions prior to 577.00
- NVIDIA RTX, Quadro, NVS (Windows) versions prior to 573.48
- Tesla (Windows) versions prior to 573.48
- GeForce (Linux) versions prior to 575.64.05
- NVIDIA RTX, Quadro, NVS (Linux) versions prior to 575.64.05
- Tesla (Linux) versions prior to 570.172.08
Vendor security history
NVIDIA has fixed multiple earlier vulnerabilities in its vGPU stack, including buffer overflows and privilege escalation issues. It publishes security advisories regularly and usually ships patches promptly. The company has a dedicated Product Security Incident Response Team (PSIRT) and works with hypervisor vendors to coordinate security updates.
