CVE-2025-23243 is a medium severity (CVSS 6.5) improper access control flaw in NVIDIA Riva on Linux. NVIDIA lists all versions up to and including 2.18.0 as affected, with possible data tampering or denial of service. The fix is Riva 2.19.0 or later.
What's affected
NVIDIA's March 2025 security bulletin for Riva lists NVIDIA Riva on Linux, all versions up to and including 2.18.0, as affected, with 2.19.0 as the updated version. The bulletin was published on 11 March 2025 and updated on 21 March 2025. Earlier releases are also affected, and NVIDIA says users on earlier releases should move to the latest one.
The bulletin covers two CVEs, CVE-2025-23242 and CVE-2025-23243, both described as improper access control issues. NVIDIA's bulletin credits David Fiser and Alfredo Oliveira of Trend Micro's Nebula team for the reports. NVIDIA also reminds readers that its risk assessment is an average and may not match your own configuration.
How to check if you're exposed
Find the Riva release you deployed. If you used the quick start scripts or a container image, the version is in the release or image tag.
docker images | grep -i riva
Anything up to and including 2.18.0 needs the update. Then look at network exposure. Riva serves speech and language models over network APIs, and the vector for both CVEs is network reachable with no privileges, so find out which hosts and networks can reach the service port.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Upgrade NVIDIA Riva to 2.19.0 or later, following the instructions on the NVIDIA Riva for Developers page.
- Restrict network access to the Riva endpoints to the applications that need them.
- Place the service behind an authenticated gateway if you expose it beyond one trusted network.
- Review whether other NVIDIA components in the same stack have recent bulletins.
- Record the new version in your inventory.
Why it matters
CWE-284 is improper access control, which means a service lets a caller do something the design did not intend. NVIDIA's bulletin says a user could cause such an issue with possible data tampering or denial of service. It does not describe the mechanism.
The score is lower than its sibling because the vector gives no confidentiality impact. It still needs no privileges and works over the network, so a medium score should not push it to the bottom of the queue if the Riva endpoint is reachable by many hosts. Patch both Riva CVEs in one move with the same release. The KEV flag is false.
Quick check
Which release is fixed?
Riva 2.19.0, per NVIDIA's March 2025 bulletin.
Does the same update cover CVE-2025-23242?
Yes. The bulletin lists 2.19.0 as the updated version for both CVEs.
Sources
Last reviewed: 19 October 2026.
