Critical NVIDIA Flaw Exposes AI Cloud Services

A critical vulnerability in the NVIDIA Container Toolkit, codenamed NVIDIAScape, poses a severe threat to managed AI cloud services, allowing attackers to escape containers and gain elevated permissions on the host server. The flaw, tracked as CVE-2025-23266, has a high-severity CVSS score of 9.0 out of 10.0.

According to a security advisory from NVIDIA, the vulnerability exists in hooks used to initialize containers. A successful exploit could lead to “escalation of privileges, data tampering, information disclosure, and denial-of-service.” The issue affects all versions of NVIDIA Container Toolkit up to and including 1.17.7 and NVIDIA GPU Operator up to 25.3.0. Patches have been released in versions 1.17.8 and 25.3.1, respectively. The NVIDIA Container Toolkit is widely used to build and run GPU-accelerated applications in Docker containers, making its security paramount for the booming AI industry.

An “Incredibly” Easy Exploit

Researchers at the cloud security firm Wiz, who discovered the flaw, revealed that it could be weaponized with a “stunningly simple three-line Dockerfile.” The vulnerability stems from a misconfiguration in how the toolkit handles the Open Container Initiative (OCI) hook “createContainer.” By manipulating the LD_PRELOAD environment variable, an attacker can trick a privileged process into loading a malicious library from within the container image, leading to a full container escape and server takeover. Wiz estimates this flaw affects 37% of cloud environments, putting the sensitive data and proprietary models of customers on shared hardware at risk.

A Pattern of Container Risk

This isn’t the first time NVIDIA’s container tools have been in the spotlight. Just a few months ago, Wiz detailed other critical bypasses (CVE-2024-0132 and CVE-2025-23359) that also could have led to a complete host takeover. This latest discovery underscores a persistent risk: as the AI tech stack grows, “old-school” infrastructure vulnerabilities remain the most immediate threat.

Researchers emphasize that containers should not be the sole security barrier, especially in multi-tenant environments. The incident serves as a critical reminder for organizations to prioritize patching and implement stronger isolation methods, such as virtualization, to protect their AI workloads. System administrators using the affected NVIDIA tools are urged to update to the latest versions immediately.