CVE-2025-23340: 
CUDA Toolkit vulnerability analysis and mitigation

NVIDIA CUDA Toolkit contains a vulnerability (CVE-2025-23340) in the nvdisasm binary where a user may cause an out-of-bounds read by passing a malformed ELF file to nvdisasm. The vulnerability was discovered by Dimitrios Tatsis of Cisco Talos and disclosed to NVIDIA on April 14, 2025. The vendor released a patch on September 23, 2025 (NVIDIA Security).

The vulnerability exists in the RELA section parsing functionality of NVIDIA nvdisasm 12.8.90. The issue occurs when processing ELF files with RELA sections having a size less than 12 bytes, which can lead to multiple out-of-bounds writes on the heap with attacker-controlled data. The vulnerability has been assigned a CVSS v3.1 Base Score of 3.3 (Low) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L and is categorized as CWE-125 (Out-of-bounds Read) (Talos Intelligence).

A successful exploit of this vulnerability may lead to a partial denial of service. The vulnerability affects all versions of NVIDIA CUDA Toolkit prior to CUDA Toolkit 13.0 across Windows and Linux platforms (NVIDIA Security).

NVIDIA has released a security update to address this vulnerability. Users are advised to update to CUDA Toolkit 13.0 or later versions. The update is available through the CUDA Toolkit Downloads page (NVIDIA Security).