NVIDIA Patches Multi Flaws in Delegated License Service, Allows Unauthenticated Access and DoS

NVIDIA has issued a security bulletin addressing multiple vulnerabilities across the NVIDIA App for Windows and the Delegated License Service (DLS) within the NVIDIA License System, with flaws ranging from privilege escalation to information disclosure, denial of service and unauthorised access.

The most notable, CVE-2025-23297, affects the NVIDIA App installer on Windows and could allow a local unprivileged attacker to escalate privileges, with a CVSS of 7.8 and versions prior to 11.0.5.245 affected; users are advised to update to NVIDIA App version 11.0.5.245. A far more severe flaw, CVE-2025-23293, lies in the DLS and could let an unauthenticated user access sensitive information and potentially execute commands, carrying a CVSS base score of 8.7 and posing a significant risk in enterprise deployments.

Additional issues include CVE-2025-23292 (SQL injection in DLS, CVSS 4.6) and CVE-2025-23291 (information disclosure, CVSS 2.4). NVIDIA has released patched versions—NVIDIA App for Windows 10/11 to v11.0.5.245 or later, and DLS on all appliance platforms to v3.5.1 or v3.1.7, with migration guidance in the NVIDIA License System User Guide. October 2025.