CVE-2025-23345: 
Bottlerocket vulnerability analysis and mitigation

CVE-2025-23345 is an out-of-bounds read vulnerability in the video decoder component of NVIDIA Display Driver for Windows and Linux. Disclosed on October 23, 2025, it affects a wide range of NVIDIA GPU product lines including GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest drivers across multiple driver branches. Successful exploitation may lead to information disclosure or denial of service. It carries a CVSS v3.1 base score of 4.4 (Medium), assigned by NVIDIA Corporation (NVIDIA Advisory, NVD).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and resides in the video decoder component of the NVIDIA Display Driver. An attacker with local access and low privileges can trigger an out-of-bounds read operation, potentially reading memory beyond the intended buffer boundary. No user interaction is required, and the attack complexity is low, making it straightforward to trigger once local access is obtained. The attack vector is local (AV:L), limiting remote exploitation without prior access to the target system (NVIDIA Advisory, NVD).

Exploitation of this vulnerability can result in limited information disclosure and denial of service conditions on affected systems. The integrity impact is low and confidentiality impact is none per the CVSS scoring, meaning an attacker is unlikely to extract sensitive data directly but may cause instability or crashes in the display driver. The scope is unchanged, confining the impact to the affected component without privilege escalation to other system components (NVIDIA Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-23345. The EPSS score is approximately 0.012%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges, which further limits the practical attack surface (NVD).

NVIDIA has released updated drivers addressing this vulnerability across all affected product lines. Users should upgrade to the following minimum versions: GeForce/RTX/Quadro/NVS/Tesla on Windows — 573.76 or 581.42 or 539.56; GeForce/RTX/Quadro/NVS/Tesla on Linux — 570.195.03, 535.274.02, or 580.95.05; vGPU guest drivers — versions beyond vGPU 16.11 (535.261.03+), vGPU 18.4 (570.172.08+/573.48+), and vGPU 19.1 (580.82.07+/581.15+). Users should consult the NVIDIA security bulletin for the specific patched version applicable to their GPU product and driver branch, and apply updates promptly (NVIDIA Advisory).

Security news outlets such as Security Online covered the broader October 2025 NVIDIA GPU driver security bulletin, noting multiple high-severity flaws addressed alongside CVE-2025-23345 (Security Online). Debian also issued a stable update announcement referencing this CVE in November 2025 (Debian Announce). Community reaction has been muted given the medium severity rating and local-only attack vector.