CVE-2025-23350: NVIDIA Bluefield Ga

Critical severity, CVSS 9.0. EPSS: 0.4% chance of exploitation in the next 30 days.

NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bounds by crafted input. A successful exploit of this vulnerability may lead to arbitrary code execution on the device.

Affected products

• NVIDIA Bluefield Ga: before 46.3008 (fixed in 46.3008)
• NVIDIA Bluefield LTS22: before 35.8002 (fixed in 35.8002)
• NVIDIA Bluefield LTS23: before 39.8002 (fixed in 39.8002)
• NVIDIA Bluefield LTS24: before 43.8002 (fixed in 43.8002)
• NVIDIA Connectx Ga: before 46.3008 (fixed in 46.3008)
• NVIDIA Connectx LTS22: before 35.8002 (fixed in 35.8002)
• NVIDIA Connectx LTS23: before 39.8002 (fixed in 39.8002)
• NVIDIA Connectx LTS24: before 43.8002 (fixed in 43.8002)

Published 2026-07-01. Last modified 2026-10-06.