CVE-2025-23358CWE-427

CVE-2025-23358

High · published November 5, 2025

CVSS v3.1
8.2
EPSS
0%
Percentile
14.3
In the wild
Unconfirmed
What it is

⚡ A local attacker can exploit a search path issue in NVIDIA's NVApp installer! 🦸‍♂️ Think of it like a delivery driver following a poorly written address that leads to the wrong house — the installer could get tricked into loading malicious code instead of the right files! 📦 If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code and escalate privileges, potentially giving them control over the system. Imagine someone walking into your house, changing the locks, and claiming it's their home now! That's the level of access they could gain!

Put simply

Think of it like a delivery driver following a poorly written address that leads to the wrong house — the installer could get tricked into loading malicious code instead of the right files! 📦 This vulnerability arises from a misconfiguration in the search path used by the NVApp installer, allowing a local attacker to manipulate it and trigger code execution.

What to do

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code and escalate privileges, potentially giving them control over the system. Imagine someone walking into your house, changing the locks, and claiming it's their home now! That's the level of access they could gain! To mitigate this risk, update to the latest version of NVApp as soon as it's available. Additionally, review your user permissions and ensure that only trusted users can run the installer. Regular audits can help catch similar issues before they become a concern! You've got this! With a little vigilance and prompt action, you'll keep your system secure! 🛡️

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00240 · 14.3th percentile
Weakness
CWE-427 · Uncontrolled Search Path Element
Published
2025-11-05T01:17Z
References (3)
EPSS history
Timeline
  • 04 NOV 19:47Z
    NVIDIA NVApp for Windows contains a vulnerability in the installer, where a local attacker can cause a search path element issue
    cvelistv5