Multiple NVIDIA Flaws Allow Attackers to Escalate Privileges on Systems

NVIDIA has issued a critical security bulletin revealing multiple vulnerabilities in its NVIDIA App software that can enable attackers to escalate privileges on Windows systems, tracked as CVE-2025-23297 with a base score of 7.8 (High) and potential impact to confidentiality, integrity and availability. The flaws stem from improper file handling during the installation of Frameview SDK components, allowing an unprivileged local user to modify files within the Frameview SDK directory and gain elevated privileges.

The issues affect NVIDIA App on Windows 10 and 11, with all versions prior to 11.0.5.245 vulnerable, and a fix was addressed in the September 2025 update; users are urged to install version 11.0.5.245 or later immediately. The article notes that an attacker would require local unprivileged access and there is no user interaction required once access is gained, potentially enabling full system compromise.

Credit for reporting CVE-2025-23297 goes to Dong-uk Kim and JunYoung Park of KAIST Hacking Lab, according to NVIDIA, with further steps including updating the software and subscribing to product security bulletins.