vGPU Escape Attacks: Breaking Isolation in Virtualised GPU Environments
For executives
NVIDIA Virtual GPU (vGPU) technology allows a single physical GPU to be shared among multiple virtual machines, each receiving a virtualised GPU with its own allocated resources. The isolation between VMs is enforced by the vGPU Manager, a privileged software component running on the hypervisor host. Three vulnerabilities in this library directly target that isolation boundary: CVE-2024-0146 (memory corruption allowing guest-to-host code execution), CVE-2025-23245 (guest accessing global host resources), and CVE-2025-23246 (guest consuming uncontrolled host resources).
How vGPU isolation works
The vGPU Manager mediates all GPU operations: it receives GPU commands from guest VMs, validates them, and submits them to the physical GPU on the guest's behalf. The Manager runs in the hypervisor context with high privileges. It has direct access to the physical GPU hardware and to the memory of all guest VMs it serves.
The attack surface
Any vulnerability in the vGPU Manager's command validation and mediation logic is a guest-to-host escape opportunity. A guest VM that sends a malformed GPU command to the Manager causes the Manager to process that command incorrectly:
Memory corruption (CVE-2024-0146): the malformed command causes the Manager to write beyond an allocated buffer, corrupting adjacent memory in the hypervisor context. Controlled memory corruption in a hypervisor-privilege process can lead to code execution at hypervisor privilege.
Unauthorised resource access (CVE-2025-23245): the malformed command causes the Manager to access global host resources that the guest's VM should not be able to reach.
Resource exhaustion (CVE-2025-23246): the malformed command causes the Manager to consume host resources beyond what the guest is entitled to, degrading or denying service to the host and other guests.
What a successful vGPU escape achieves
A vGPU Manager memory corruption exploit that achieves code execution at hypervisor privilege gives the attacker: control of the hypervisor host including the GPU hardware and the vGPU Manager itself, access to the GPU memory of all other guest VMs, and the ability to read, modify, or terminate any guest VM on the hypervisor.