Skip to main content

CVE-2025-23266 (NVIDIAScape): A Three-Line Container Escape in the NVIDIA Container Toolkit

CVEScoreNameAffectedPatchedDisclosed
CVE-2025-232669.0 CriticalNVIDIAScapeContainer Toolkit ≤ v1.17.7 / GPU Operator ≤ 25.3.0Toolkit v1.17.8 / Operator 25.3.1July 15, 2025

Discovered by Nir Ohfeld and Shir Tamari (Wiz Research) and Lei Wang (Nebula Security Lab, Huawei Cloud).

For executives​

Every GPU container in every AI environment runs a component called the NVIDIA Container Toolkit. In July 2025, a critical flaw in that component was found allowing an attacker to push a malicious container image and gain full administrative control of the physical server underneath it, including every other workload running on the same node. The vulnerability requires no credentials, no prior access, and no GPU knowledge. A three-line change to a Dockerfile is the entire attack. It is the third critical or high-severity disclosure in the NVIDIA Container Toolkit in under a year.

How the OCI hook system works​

The Open Container Initiative specification defines a hook system that allows tools to run scripts at specific points in a container's lifecycle. The NVIDIA Container Toolkit uses these hooks to perform its core function: configuring containers to communicate with host NVIDIA drivers and GPUs.

Two hook types matter here. Prestart hooks run in a clean, isolated environment after namespace setup is complete. The createContainer hook runs earlier, before namespace isolation is fully established. That timing difference is where the vulnerability lives.

The flaw​

The createContainer hook inherited environment variables directly from the container image without filtering them. Whatever was in the container's environment was visible to a root-level host process.

LD_PRELOAD is a standard Linux mechanism that instructs any process to load a specified shared library before all others. Set LD_PRELOAD in a container's Dockerfile, and the nvidia-ctk hook will load whatever library you specified, before its own code runs, with root privileges on the host.

The complete exploit:

FROM nvidia/cuda:12.4.1-base
ENV LD_PRELOAD=/tmp/libescape.so
COPY libescape.so /tmp/

Wiz characterized the exploit as "incredibly easy to weaponize."

Why multi-tenant environments are most exposed​

The NVIDIA Container Toolkit is installed in 100% of GPU containers because there is no alternative path to GPU access. In multi-tenant environments, the blast radius of a single compromised or malicious container extends to every co-located workload. A successful exploit on one tenant's container gives an attacker root access to the host and full visibility into every other tenant's GPU memory.

The detection problem​

The createContainer hook runs before the container's own process tree is established. Process monitoring, syscall tracing, and endpoint detection tools observe container behavior once a container is running. They have no instrumentation at the hook execution layer. By the time any container appears in conventional security telemetry, a successful NVIDIAScape exploit is already complete.

Patch and mitigation​

Upgrade the NVIDIA Container Toolkit to v1.17.8 or later. Upgrade the NVIDIA GPU Operator to version 25.3.1 or later. For environments where immediate upgrade is not possible, NVIDIA provides a configuration workaround: set disable-cuda-compat-lib-hook = true in /etc/nvidia-container-toolkit/config.toml.

Note: CVE-2025-23266 does not affect systems where crun is used as the low-level container runtime.