CVE-2025-23242 is a high severity (CVSS 7.3) improper access control flaw in NVIDIA Riva on Linux. NVIDIA says all versions up to and including 2.18.0 are affected, and the impact may include privilege escalation, data tampering, denial of service or information disclosure. Upgrade to Riva 2.19.0 or later.
What's affected
NVIDIA's March 2025 security bulletin for Riva lists NVIDIA Riva on Linux, all versions up to and including 2.18.0, as affected, with 2.19.0 as the updated version. The bulletin was published on 11 March 2025 and updated on 21 March 2025. Earlier releases are also affected, and NVIDIA says users on earlier releases should move to the latest one.
The bulletin covers two CVEs, CVE-2025-23242 and CVE-2025-23243, both described as improper access control issues. NVIDIA's bulletin credits David Fiser and Alfredo Oliveira of Trend Micro's Nebula team for the reports. NVIDIA also reminds readers that its risk assessment is an average and may not match your own configuration.
How to check if you're exposed
Find the Riva release you deployed. If you used the quick start scripts or a container image, the version is in the release or image tag.
docker images | grep -i riva
Anything up to and including 2.18.0 needs the update. Then look at network exposure. Riva serves speech and language models over network APIs, and the vector for both CVEs is network reachable with no privileges, so find out which hosts and networks can reach the service port.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Upgrade NVIDIA Riva to 2.19.0 or later, following the instructions on the NVIDIA Riva for Developers page.
- Restrict network access to the Riva endpoints to the applications that need them.
- Place the service behind an authenticated gateway if you expose it beyond one trusted network.
- Review whether other NVIDIA components in the same stack have recent bulletins.
- Record the new version in your inventory.
Why it matters
CWE-284 is improper access control. NVIDIA's bulletin gives only a short description: a user could cause an improper access control issue, with possible escalation of privileges, data tampering, denial of service or information disclosure. It gives no further technical detail, and this guide does not add any.
The vector shows network access, low complexity, no privileges and low impact on each of confidentiality, integrity and availability. That combination is why the score is 7.3 rather than higher. For AI services the practical lesson is to treat model serving endpoints like any other network service: authenticate, restrict and monitor. The KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What fixes CVE-2025-23242?
NVIDIA lists Riva 2.19.0 as the updated version. Versions up to and including 2.18.0 on Linux are affected.
How does it differ from CVE-2025-23243?
Both are improper access control in Riva. This one scores 7.3 and lists privilege escalation among its impacts. The other scores 6.5 and lists data tampering and denial of service.
Sources
Last reviewed: 19 October 2026.
