CVE-2025-23353

{"id": "CVE-2025-23353", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-23353", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-09-24T13:35:45.447857Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@nvidia.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "psirt@nvidia.com", "affectedData": [{"vendor": "NVIDIA", "product": "Megatron-LM", "versions": [{"status": "affected", "version": "All versions prior to 0.13.1 and 0.12.3"}], "platforms": ["All platforms"], "defaultStatus": "unaffected"}]}], "published": "2025-09-24T14:15:49.000", "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23353", "tags": ["Technical Description"], "source": "psirt@nvidia.com"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5698", "tags": ["Vendor Advisory"], "source": "psirt@nvidia.com"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-23353", "tags": ["Technical Description"], "source": "psirt@nvidia.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@nvidia.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "NVIDIA Megatron-LM for all platforms contains a vulnerability in the msdp preprocessing script where malicious data created by an attacker may cause an injection. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, Information disclosure, and data tampering."}, {"lang": "es", "value": "NVIDIA Megatron-LM para todas las plataformas contiene una vulnerabilidad en el script de preprocesamiento msdp donde datos maliciosos creados por un atacante pueden causar una inyecci\u00f3n. Un exploit exitoso de esta vulnerabilidad puede conducir a la ejecuci\u00f3n de c\u00f3digo, escalada de privilegios, revelaci\u00f3n de informaci\u00f3n y manipulaci\u00f3n de datos."}], "lastModified": "2026-06-17T08:53:43.937", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nvidia:megatron-lm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40688FC1-A694-40A0-8867-533D75E3D663", "versionEndExcluding": "0.12.3"}, {"criteria": "cpe:2.3:a:nvidia:megatron-lm:0.13.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "88170FF5-D7DD-4A93-AAF2-F242D0424C60"}, {"criteria": "cpe:2.3:a:nvidia:megatron-lm:0.13.0:rc0:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56C05919-6676-46E1-8B24-BE6A036B0EAF"}, {"criteria": "cpe:2.3:a:nvidia:megatron-lm:0.13.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8CC73855-225F-470E-96CD-6E8B1E93DF40"}, {"criteria": "cpe:2.3:a:nvidia:megatron-lm:0.13.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8E51E952-94AA-469B-AB40-999ADCBAE990"}, {"criteria": "cpe:2.3:a:nvidia:megatron-lm:0.13.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0DABFE13-C8B5-44E2-9F40-54853739A83E"}, {"criteria": "cpe:2.3:a:nvidia:megatron-lm:0.13.0:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63A13E74-658C-44C8-BEA4-D3465DA42B1E"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@nvidia.com"}