Introduction: real-world impact
Attackers can use a single misstep in NVIDIA's Display Driver to execute arbitrary code, escalate privileges, or tamper with data on millions of Windows and Linux systems. The flaw reaches gaming PCs, workstations, and data center servers running AI and visualization workloads, so individuals and enterprises both need to patch.
NVIDIA dominates the GPU industry. Its hardware and software run consumer gaming, professional visualization, AI research, and cloud computing. Because its product lines (GeForce, RTX, Quadro, NVS, Tesla) are so broad and are deployed in critical infrastructure, a vulnerability in NVIDIA drivers has wide-reaching consequences.
Technical information
CVE-2025-23309 is a high-severity flaw (CVSS 8.2) classified under CWE-427 (Uncontrolled Search Path Element). It is present in NVIDIA Display Drivers for Windows and Linux, and in vGPU and cloud gaming components. The driver loads certain DLLs without specifying a fully qualified path, so Windows falls back to its DLL search order, which checks user-writable directories early in the sequence.
An attacker who can write to a directory in the DLL search path can place a malicious DLL there with the same name as a legitimate library the NVIDIA driver expects. When the driver loads that DLL, the attacker's code runs with the privileges of the driver process. GPU drivers often run with elevated or system-level privileges, so successful exploitation can result in privilege escalation, arbitrary code execution, denial of service, or data tampering.
The flaw affects driver branches R580, R570, and R535 across a wide range of NVIDIA products, including GeForce, RTX, Quadro, NVS, and Tesla. Both standalone drivers and virtual GPU (vGPU) environments are affected. As of this writing, no public code snippets or PoC are available.
Patch information
NVIDIA has released updates that fix CVE-2025-23309 on all affected platforms and driver branches. Users and organizations must update to the following versions or later:
Windows Drivers:
- R580: Update to 581.42
- R570: Update to 573.76
- R535: Update to 539.56
Linux Drivers:
- R580: Update to 580.95.05
- R570: Update to 570.195.03
- R535: Update to 535.274.02
vGPU Software (Virtual GPU Manager):
- R580: Update to 580.95.02
- R570: Update to 570.195.02
- R535: Update to 535.274.02
Cloud Gaming Software (Guest Driver):
- R580: Update to 580.95.05
- R570: Update to 570.195.03
- R535: Update to 535.274.02
NVIDIA strongly recommends updating to these versions immediately to reduce the risk of exploitation. Official patch sources:
Affected systems and versions
Windows:
- GeForce, RTX, Quadro, NVS, Tesla
- R580: All versions prior to 581.42
- R570: All versions prior to 573.76
- R535: All versions prior to 539.56
Linux:
- GeForce, RTX, Quadro, NVS, Tesla
- R580: All versions prior to 580.95.05
- R570: All versions prior to 570.195.03
- R535: All versions prior to 535.274.02
vGPU Software (Virtual GPU Manager):
- R580: All versions up to and including the August 2025 release
- R570: All versions up to and including the August 2025 release
- R535: All versions up to and including the August 2025 release
Cloud Gaming Software (Guest Driver):
- R580: All versions up to and including the August 2025 release
- R570: All versions up to and including the August 2025 release
- R535: All versions up to and including the August 2025 release
Vendor security history
NVIDIA publishes security bulletins on a regular schedule and has a history of fixing vulnerabilities in its GPU drivers, including privilege escalation, code execution, and information disclosure issues. It coordinates patch releases across multiple driver branches and platforms. In October 2025, NVIDIA began publishing its security bulletins on GitHub to make them more transparent and easier to integrate with automated vulnerability management tools. Previous advisories have covered similar privilege escalation and code execution flaws, and NVIDIA has generally released patches for them promptly.
