NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an attacker could read invalid memory. A successful exploit of this vulnerability might lead to information disclosure.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03247-1 advisory.

    Updated CUDA variant to 580.82.07:

    - CVE-2025-23277: Fixed access memory outside bounds permitted under normal       use cases in NVIDIA Display Driver (bsc#1247528).
    - CVE-2025-23278: Fixed improper index validation by issuing a call with       crafted parameters in NVIDIA Display Driver (bsc#1247529).
    - CVE-2025-23286: Fixed invalid memory read in NVIDIA GPU Display Driver (bsc#1247530).
    - CVE-2025-23283: Fixed stack buffer overflow triggerable by a malicious guest       in Virtual GPU Manager in NVIDIA vGPU software (bsc#1247531).
    - CVE-2025-23279: Fixed race condition that lead to privileges escalations       in NVIDIA .run Installer (bsc#1247532).

    Update non-CUDA variant to 580.82.07 (bsc#1249235).

    Other fixes:

    - Added Requires to be provided by special versions of nvidia-modprobe and       nvidia-persitenced built against SP4 (bsc#1237208, jsc#PED-13295).
    - Get rid of rule of older KMPs not to load nvidia_drm module,       which are still installed in parallel and therefore still       active (bsc#1247923).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03246-1 advisory.

    Updated CUDA variant to 580.82.07:

    - CVE-2025-23277: Fixed access to memory outside bounds permitted under normal       use cases in NVIDIA Display Driver (bsc#1247528).
    - CVE-2025-23278: Fixed improper index validation by issuing a call with       crafted parameters in NVIDIA Display Driver (bsc#1247529).
    - CVE-2025-23286: Fixed invalid memory read in NVIDIA GPU Display Driver (bsc#1247530).
    - CVE-2025-23283: Fixed stack buffer overflow triggerable by a malicious guest       in Virtual GPU Manager in NVIDIA vGPU software (bsc#1247531).
    - CVE-2025-23279: Fixed race condition that leads to privileges escalations       in NVIDIA .run Installer (bsc#1247532).

    Update non-CUDA variant to 580.82.07 (bsc#1249235).

    Other fixes:

    - Added Requires to be provided by special versions of nvidia-modprobe and       nvidia-persitenced built against SP4 (bsc#1237208, jsc#PED-13295).
    - Get rid of rule of older KMPs not to load nvidia_drm module,       which are still installed in parallel and therefore still       active (bsc#1247923).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03062-1 advisory.

    Updated CUDA variant to 580.65.06:

    - CVE-2025-23277: Fixed access memory outside bounds permitted under normal       use cases in NVIDIA Display Driver (bsc#1247528)
    - CVE-2025-23278: Fixed improper index validation by issuing a call with       crafted parameters in NVIDIA Display Driver (bsc#1247529)
    - CVE-2025-23286: Fixed invalid memory read in NVIDIA GPU Display Driver (bsc#1247530)
    - CVE-2025-23283: Fixed stack buffer overflow triggerable by a malicious guest       in Virtual GPU Manager in NVIDIA vGPU software (bsc#1247531)
    - CVE-2025-23279: Fixed race condition that lead to privileges escalations       in NVIDIA .run Installer (bsc#1247532)


    Updated non-CUDA variant to 570.172.08 (bsc#1246327)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an attacker could read     invalid memory. A successful exploit of this vulnerability might lead to information disclosure.
    (CVE-2025-23286)

Note that Nessus relies on the presence of the package as reported by the vendor.

A display driver installed on the remote Linux host is affected by multiple vulnerabilities, including the following:

  - NVIDIA Display Driver for Linux and Windows contains a vulnerability in the kernel mode driver, where an     attacker could access memory outside bounds permitted under normal use cases. A successful exploit of this     vulnerability might lead to denial of service, data tampering, or information disclosure. (CVE-2025-23277)

  - NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker might cause     an improper index validation by issuing a call with crafted parameters. A successful exploit of this     vulnerability might lead to data tampering  or denial of service. (CVE-2025-23278)

  - NVIDIA .run Installer for Linux and Solaris contains a vulnerability where an attacker could use a race     condition to escalate privileges. A successful exploit of this vulnerability might lead to code execution,     escalation of privileges, information disclosure, denial of service, or data tampering. (CVE-2025-23279)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the driver's self-reported version number.

The NVIDIA Virtual GPU Manager software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities, including the following:

  - NVIDIA Display Driver for Linux and Windows contains a vulnerability in the kernel mode driver, where an     attacker could access memory outside bounds permitted under normal use cases. A successful exploit of this     vulnerability might lead to denial of service, data tampering, or information disclosure. (CVE-2025-23277)

  - NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker might cause     an improper index validation by issuing a call with crafted parameters. A successful exploit of this     vulnerability might lead to data tampering  or denial of service. (CVE-2025-23278)

  - NVIDIA .run Installer for Linux and Solaris contains a vulnerability where an attacker could use a race     condition to escalate privileges. A successful exploit of this vulnerability might lead to code execution,     escalation of privileges, information disclosure, denial of service, or data tampering. (CVE-2025-23279)

  - NVIDIA vGPU software for Linux-style hypervisors contains a vulnerability in the Virtual GPU Manager,     where a malicious guest could cause stack buffer overflow. A successful exploit of this vulnerability     might lead to code execution, denial of service, escalation of privileges, information disclosure,     or data tampering. (CVE-2025-23283)

  - NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could     cause a stack buffer overflow. A successful exploit of this vulnerability might lead to code execution,     denial of service, information disclosure, or data tampering. (CVE-2025-23284)

  - NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where it allows a guest     to access global resources. A successful exploit of this vulnerability might lead to denial of     service. (CVE-2025-23285)

  - NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a guest could get global     GPU metrics which may be influenced by work in other VMs. A successful exploit of this vulnerability     might lead to information disclosure. (CVE-2025-23290) 	Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
265407	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : nvidia-open-driver-G06-signed (SUSE-SU-2025:03247-1)	Nessus	SuSE Local Security Checks	high
265405	SUSE SLED15 / SLES15 Security Update : nvidia-open-driver-G06-signed (SUSE-SU-2025:03246-1)	Nessus	SuSE Local Security Checks	high
261228	SUSE SLES15 Security Update : nvidia-open-driver-G06-signed (SUSE-SU-2025:03062-1)	Nessus	SuSE Local Security Checks	high
249827	Linux Distros Unpatched Vulnerability : CVE-2025-23286	Nessus	Misc.	medium
243282	NVIDIA Linux GPU Display Driver (July 2025)	Nessus	Misc.	high
243281	NVIDIA Virtual GPU Manager Multiple Vulnerabilities (July 2025)	Nessus	Misc.	high

Detections

Analytics

CVE-2025-23286

medium

Tenable Plugins

high

high

high

medium

high

high