CVE-2026-65125 is a medium severity (CVSS 6.6) external control of file name or path flaw in NVIDIA Infrastructure Controller for Linux. NVIDIA lists versions 0 to 1.9 as affected and version 2.0 as the update. Install 2.0 from the NVIDIA infra-controller repository and restrict who holds high privilege accounts on the controller.
What's affected
NVIDIA's bulletin lists NVIDIA Infrastructure Controller for Linux, versions 0 to 1.9, as affected. The updated version is 2.0. The bulletin says to clone or update the software from the NVIDIA/infra-controller repository on GitHub.
The same bulletin covers a set of Infrastructure Controller issues published together, and this CVE is one row in that table. Its CVSS 3.1 base score is 6.6 (Medium) with the vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. NVIDIA and the record agree on that score, so there is no conflict to report between the two.
The bulletin does not describe the vulnerable code path in detail. NVIDIA's wording is short: an attacker could cause external control of a file name or path, which might lead to code execution, escalation of privileges, data tampering, and denial of service.
How to check if you're exposed
Find out whether anyone in your organization runs Infrastructure Controller at all. It is a specialised infrastructure product, so it may live with a platform or data center team rather than in your usual application inventory.
If you do run it, check the installed version against the range above. The bulletin's affected range is 0 to 1.9, so anything older than 2.0 should be treated as in scope. How you read the version depends on how you deployed the software, and the bulletin does not give a command, so use the deployment's own version output or the commit you cloned from the repository.
Also note where the controller sits on your network. The vector marks the attack vector as network and the attack complexity as high, and it requires high privileges, so an attacker would first need an account with strong rights on the controller. An exposed management interface raises the risk and a well isolated one lowers it.
What to do now
- Inventory every Infrastructure Controller deployment and record its version.
- Update to version 2.0 or later from the NVIDIA/infra-controller repository, following NVIDIA's bulletin.
- Review who holds high privilege accounts on the controller and remove any that are not needed.
- Restrict network access to the controller's management surface to the hosts that must reach it.
- Read the other entries in bulletin 5879, since several were fixed in the same 2.0 release and some carry higher scores.
Why it matters
The weakness class is CWE-73, external control of file name or path. It means a value that an outside party can influence is used to build a path that the software then reads or writes. If the software does not confine that value to the places it expects, the path can point somewhere it should not.
The scores here are held down by the privilege requirement and the attack complexity. Medium does not mean ignore it. A controller sits near the infrastructure it manages, so a compromised high privilege account on it is worth more to an attacker than the number suggests.
The bulletin lists the possible results as code execution, escalation of privileges, data tampering and denial of service. Those are the generic impact categories NVIDIA publishes, not a description of a specific attack. No source I reviewed says this CVE is exploited in the wild, and the record's KEV flag is false.
Because the bulletin is a batch, the practical path is simple. Move to 2.0, then read the whole table once so you know what else changed.
Quick check
Is this CVE being exploited in the wild?
The record's CISA Known Exploited Vulnerabilities flag is false, and NVIDIA's bulletin does not mention exploitation. Treat it as a patch in your normal cycle, sooner if the controller is reachable from untrusted networks.
Which version fixes it?
NVIDIA lists version 2.0 as the updated version for affected releases from 0 to 1.9. Confirm against the bulletin before you roll out.
Sources
Last reviewed: 18 October 2026.
