CVE record · CVE-2025-23299

Out-of-bounds write in NVIDIA BlueField GA and others

CVSS 6.7 MediumEPSS 0.0018 · 7th percentile

Published by the CVE Program (CNA: nvidia) at 22 Oct 2025, 15:14 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
NVIDIA	BlueField GA	affected All versions prior to 46.1006 Other versions: unaffected
NVIDIA	BlueField LTS22	affected All versions prior to 35.4554 Other versions: unaffected
NVIDIA	BlueField LTS23	affected All versions prior to 39.5050 Other versions: unaffected
NVIDIA	BlueField LTS24	affected All versions prior to 43.3608 Other versions: unaffected
NVIDIA	ConnectX GA	affected All versions prior to 46.1006 Other versions: unaffected
NVIDIA	ConnectX LTS22	affected All versions prior to 35.4554 Other versions: unaffected
NVIDIA	ConnectX LTS23	affected All versions prior to 39.5050 Other versions: unaffected
NVIDIA	ConnectX LTS24	affected All versions prior to 43.3608 Other versions: unaffected
NVIDIA	ConnectX-4 LX	affected All versions prior to 32.1908 Other versions: unaffected

Identifiers: CVE-2025-23299
CNA: nvidia
Weakness (CWE): CWE-787
Tags: NVIDIA BlueField GA
NVIDIA BlueField LTS22
NVIDIA BlueField LTS23
NVIDIA BlueField LTS24
NVIDIA ConnectX GA
NVIDIA ConnectX LTS22
NVIDIA ConnectX LTS23
NVIDIA ConnectX LTS24
Memory corruption
Published: 22 Oct 2025
Updated: 22 Oct 2025

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
6.7	Medium	3.1	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	CNA (nvidia)

CISA KEV Not listed.
EPSS 0.0018, the 7th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 22 Oct 2025. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.