High

Uncontrolled DLL Loading in NVIDIA Display Driver

IdentifiersCVE-2025-23309CWE-427· Uncontrolled Search Path Element

CVE-2025-23309 is a high-severity vulnerability in NVIDIA Display Driver components affecting Windows and Linux deployments, as well as NVIDIA vGPU Software and cloud gaming guest drivers across the R580, R570, and R535 branches. The flaw is classified as CWE-427 (Uncontrolled Search Path Element) and is caused by the driver failing to specify a fully qualified path when loading certain DLLs. On Windows, this causes the normal DLL search order to be used; if a user-writable directory is searched before a trusted location, an attacker can place a malicious DLL with the expected name and have it loaded by the NVIDIA driver or associated process. The result is execution of attacker-controlled code in the context of the vulnerable driver component, with secondary impacts including privilege escalation, denial of service, and data tampering.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can allow arbitrary code execution in the context of the vulnerable NVIDIA driver component or associated process. Depending on that execution context, this may enable local privilege escalation, data tampering, and denial of service. Because the affected software spans consumer GPU drivers, enterprise workstation deployments, virtual GPU environments, and cloud gaming components, the operational impact can extend from compromise of individual endpoints to disruption or compromise of shared GPU-enabled infrastructure.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure by preventing untrusted users from writing to directories that may be searched during DLL resolution, tightening filesystem permissions on application and working directories, and minimizing execution of vulnerable NVIDIA components in contexts where attacker-controlled paths are reachable. In multi-user or virtualized environments, restrict local write access and monitor for unexpected DLLs placed in directories associated with NVIDIA driver or application loading paths. These are compensating controls only; vendor updates are the primary mitigation.

Remediation

Patch, then assume compromise.

Apply NVIDIA’s patched releases for the affected branch and platform. The content identifies the following fixed versions: Windows R580 581.42 or later, Windows R570 573.76 or later, Windows R535 539.56 or later; Linux R580 580.95.05 or later, Linux R570 570.195.03 or later, Linux R535 535.274.02 or later; vGPU Software R580 580.95.02 or later, vGPU Software R570 570.195.02 or later, vGPU Software R535 535.274.02 or later; Cloud Gaming Software guest drivers R580 580.95.05 or later, R570 570.195.03 or later, and R535 535.274.02 or later. NVIDIA strongly recommends updating affected systems immediately.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

zeropath blogNews

Oct 23, 2025

NVIDIA Project G-Assist CVE-2025-23347 Privilege Escalation: Brief Summary and Technical Review - ZeroPath Blog | ZeroPath

A DLL loading path issue mentioned as another vulnerability disclosed in NVIDIA's October 2025 bulletin.

zeropath blogNews

Oct 10, 2025

NVIDIA Display Driver CVE-2025-23280: Brief Summary of a Use After Free Vulnerability on Linux - ZeroPath Blog | ZeroPath

An uncontrolled DLL loading vulnerability in NVIDIA's Windows driver/software ecosystem mentioned as part of the October 2025 security bulletin.

zeropath blogNews

Oct 10, 2025

NVIDIA Display Driver CVE-2025-23309: Brief Summary of a High-Risk DLL Hijacking Vulnerability - ZeroPath Blog | ZeroPath

A high-severity uncontrolled search path vulnerability in NVIDIA Display Drivers for Windows and Linux, including vGPU and cloud gaming components, that can allow arbitrary code execution, privilege escalation, denial of service, or data tampering via malicious DLL loading.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3