CVE-2025-23346: 
CUDA Toolkit vulnerability analysis and mitigation

CVE-2025-23346 is a NULL pointer dereference vulnerability in the cuobjdump utility of the NVIDIA CUDA Toolkit, allowing an unprivileged local user to trigger a limited denial of service. It affects all CUDA Toolkit versions prior to 13.0.0 on both Windows and Linux platforms. The vulnerability was disclosed by NVIDIA Corporation on September 24, 2025, with NVD initial analysis completed on October 6, 2025. It carries a CVSS v3.1 base score of 3.3 (Low), assigned by NVIDIA (NVIDIA Advisory, Red Hat CVE).

The vulnerability is classified as CWE-476 (NULL Pointer Dereference) and resides in the cuobjdump command-line utility included with the NVIDIA CUDA Toolkit. An unprivileged user can supply a crafted input to cuobjdump that causes the application to dereference a NULL pointer, resulting in a crash. Exploitation requires local access and user interaction (e.g., a user running cuobjdump against a malicious file), and no elevated privileges are needed. No public proof-of-concept or detailed technical write-up has been identified (NVIDIA Advisory, Red Hat CVE).

Successful exploitation results in a limited denial of service — specifically, a crash of the cuobjdump process. There is no impact on confidentiality or integrity, and the availability impact is confined to the affected utility rather than the broader system or GPU workloads. The vulnerability does not enable code execution, privilege escalation, or lateral movement, making its overall risk low (NVIDIA Advisory, Red Hat CVE).

NVIDIA has released CUDA Toolkit version 13.0.0 as the fix for this vulnerability; users should upgrade to version 13.0.0 or later. As interim mitigations, organizations should limit local user access to systems running the CUDA Toolkit, apply least-privilege principles to restrict who can execute cuobjdump, and monitor for unexpected crashes of the utility. No configuration-based workaround has been published by NVIDIA (NVIDIA Advisory).