Skip to main content

September 2025 CUDA Toolkit Bulletin: Heap Overflow and Stack Overflow Return to nvdisasm and cuobjdump

CVEScoreToolTypeDisclosed
CVE-2025-23308HighnvdisasmHeap-based buffer overflowSeptember 24, 2025
CVE-2025-23339HighcuobjdumpStack-based buffer overflowSeptember 24, 2025
CVE-2025-23275MediumnvdisasmOut-of-bounds writeSeptember 24, 2025

For executives​

Seven months after Palo Alto Networks Unit 42 disclosed nine vulnerabilities in NVIDIA's CUDA Toolkit analysis tools, a new batch of vulnerabilities in the same tools was disclosed. CVE-2025-23308 is a heap-based buffer overflow in nvdisasm that leads to code execution. CVE-2025-23339 is a stack-based buffer overflow in cuobjdump with the same consequence. Both require only that the tool be run against a malicious GPU binary file. The tools were patched, then new vulnerabilities in the same tools were found. The February 2025 disclosure taught researchers where to look.

CVE-2025-23308: heap-based buffer overflow in nvdisasm​

Malformed ELF input causes the tool to write data beyond the bounds of a heap-allocated buffer, corrupting adjacent heap memory. Heap-based buffer overflows are generally more controllable than stack-based ones from an exploit development perspective.

CVE-2025-23339: stack-based buffer overflow in cuobjdump​

The binary parser writes past the end of a stack-allocated buffer when processing specific ELF structures. Stack overflows can corrupt the function's return address, giving an attacker control of execution flow after the function returns.

Why the same tools, again​

Fuzzing campaigns produce crashes from the code paths the fuzzer explored. Patching those crashes does not guarantee the fuzzer explored every vulnerable code path. CVE-2025-23308 and CVE-2025-23339 likely come from different researchers or tools targeting the same parser with different inputs. A third batch is plausible.

Patch​

Upgrade to CUDA Toolkit version 13.0 or later.