NVIDIA GPU Driver Patches Multiple High-Severity Flaws Risking RCE and Privilege Escalation

NVIDIA has released an important security update for its GPU Display Driver to fix multiple high-severity vulnerabilities that could lead to code execution, privilege escalation, data tampering or denial of service across Windows, Linux, vGPU and cloud gaming components. The fixes cover driver branches R580, R570 and R535 and apply to GeForce, RTX/Quadro/NVS and Tesla products.

Notable flaws include CVE-2025-23309 in the Display Driver with an uncontrolled DLL loading path that could cause denial of service, privilege escalation, code execution and data tampering (CVSS 8.2), and CVE-2025-23347 in NVIDIA Project G-Assist allowing local privilege escalation and potential code execution and other impacts (CVSS 7.8).

Additional issues include CVE-2025-23280 and CVE-2025-23282 relating to Linux driver use-after-free and race conditions (CVSS 7.0 each), and CVE-2025-23345 a cross-platform video decoder flaw (CVSS 4.4). The bulletin also warns of CVE-2025-23352 affecting the Virtual GPU Manager in NVIDIA vGPU software, which could enable code execution or other impacts in virtualised environments.

Patches are available via NVIDIA Driver Downloads and the NVIDIA Licensing Portal, with fixed versions listed for Windows (R580 to 581.42, R570 to 573.76, R535 to 539.56) and Linux (580.95.05, 570.195.03, 535.274.02).