« Volver al listado

CVE-2025-23272

Estado: AplazadaMedia (5.7)—

NVIDIA nvJPEG library contains a vulnerability where an attacker can cause an out-of-bounds read by means of a specially crafted JPEG file. A successful exploit of this vulnerability might lead to information disclosure or denial of service.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Nvidia — NvjpegAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-23272",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-23272",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-09-24T18:44:09.549946Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@nvidia.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.7,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 1.4
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@nvidia.com",
      "affectedData": [
        {
          "vendor": "NVIDIA",
          "product": "NVIDIA CUDA Toolkit",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to CUDA Toolkit 12.9 Update 1"
            }
          ],
          "platforms": [
            "Windows",
            "Linux"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "NVIDIA",
          "product": "nvJPEG",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to nvJPEG 25.03"
            }
          ],
          "platforms": [
            "Linux x86_64",
            "Linux sbsa Jetson",
            "Windows",
            "Linux for Tegra",
            "DriveOS"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-09-24T14:15:47.203",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23272",
      "source": "psirt@nvidia.com"
    },
    {
      "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5661",
      "source": "psirt@nvidia.com"
    },
    {
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-23272",
      "source": "psirt@nvidia.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@nvidia.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "NVIDIA nvJPEG library contains a vulnerability where an attacker can cause an out-of-bounds read by means of a specially crafted JPEG file. A successful exploit of this vulnerability might lead to information disclosure or denial of service."
    },
    {
      "lang": "es",
      "value": "La biblioteca nvJPEG de NVIDIA contiene una vulnerabilidad donde un atacante puede causar una lectura fuera de límites mediante un archivo JPEG especialmente diseñado. Un exploit exitoso de esta vulnerabilidad podría conducir a la revelación de información o a la denegación de servicio."
    }
  ],
  "lastModified": "2026-09-26T00:10:00.127",
  "sourceIdentifier": "psirt@nvidia.com"
}