Introduction
In virtualized GPU environments, the privilege boundary between guest and host is critical for cloud providers, research institutions, and enterprises running sensitive workloads. One flaw in the software that manages GPU resources can let a malicious guest compromise the host, disrupt services, or read confidential data belonging to neighboring tenants. CVE-2025-23352, a high-severity vulnerability in NVIDIA's Virtual GPU (vGPU) software, is that kind of flaw.
NVIDIA is the dominant vendor of GPU hardware and virtualization software, and its vGPU stack runs in data centers, cloud platforms, and professional visualization environments worldwide. The Virtual GPU Manager lets multiple virtual machines share one physical GPU, which makes it the foundation of GPU-accelerated virtualization at scale. A vulnerability in this component has broad consequences for security and reliability across industries.
Technical information
CVE-2025-23352 is a memory safety vulnerability classified as CWE-824 (Access of Uninitialized Pointer). It sits in the Virtual GPU Manager component of NVIDIA vGPU software. A guest virtual machine with access to a vGPU can send specially crafted GPU commands that reach a code path where a pointer variable is read before it is initialized. The Virtual GPU Manager runs with elevated privileges on the hypervisor host, so this uninitialized pointer access can lead to several outcomes:
- Arbitrary code execution in the context of the host
- Denial of service by crashing the Virtual GPU Manager or corrupting memory
- Escalation of privileges from guest to host
- Information disclosure from unintended memory reads
- Data tampering by corrupting host memory structures
The attack vector is local. The attacker needs code execution inside a guest VM that has a vGPU assigned, but only low privileges. No user interaction is required. The attacker triggers the vulnerability by sending crafted GPU API calls from the guest to the Virtual GPU Manager. NVIDIA has not publicly disclosed the exact code path or the pointer variable involved, and no public source offers code snippets or proof-of-concept details.
Affected systems and versions
CVE-2025-23352 affects three major release branches of NVIDIA vGPU software:
- vGPU Software 19 on R580 driver branch: all versions prior to 19.2 (Linux Virtual GPU Manager 580.95.02, Windows Virtual GPU Manager 581.42)
- vGPU Software 18 on R570 driver branch: all versions prior to 18.5 (Linux Virtual GPU Manager 570.195.02, Windows Virtual GPU Manager 573.79)
- vGPU Software 16 on R535 driver branch: all versions prior to 16.12 (Linux Virtual GPU Manager 535.274.03, Windows Virtual GPU Manager 539.56)
Every supported hypervisor platform is affected, including VMware vSphere, Citrix Hypervisor, Red Hat Enterprise Linux with KVM, Ubuntu with KVM, and Nutanix AHV. Both the Linux and Windows versions of the Virtual GPU Manager contain the vulnerability. Any configuration where a guest VM has a vGPU assigned and can send GPU commands to the Virtual GPU Manager is at risk.
Vendor security history
NVIDIA's GPU driver and vGPU software stack have a history of security issues. Earlier vulnerabilities included buffer overflows, race conditions, and other memory safety flaws in privileged GPU management components. The company runs a dedicated Product Security Incident Response Team (PSIRT) and generally coordinates patch releases across multiple branches. NVIDIA has recently become more transparent by publishing security bulletins on GitHub in machine-readable formats, which makes them easier to integrate with automated patch management systems.
