Cybersecurity researchers have uncovered a severe vulnerability in NVIDIA’s Container Toolkit that could compromise managed AI cloud services worldwide. The flaw, designated CVE-2025-23266 and nicknamed “NVIDIAScape,” has earned a critical CVSS score of 9.0 out of 10.

## The Vulnerability

Google-owned security firm Wiz discovered this container escape vulnerability that affects how NVIDIA’s toolkit initializes containers. According to NVIDIA’s security advisory, the flaw allows attackers to execute malicious code with elevated permissions, potentially leading to:

– Privilege escalation
– Data tampering
– Information disclosure
– Denial-of-service attacks

## Affected Systems and Impact

The vulnerability impacts all versions of NVIDIA Container Toolkit up to 1.17.7 and NVIDIA GPU Operator up to 25.3.0. NVIDIA has released patches in versions 1.17.8 and 25.3.1 respectively.

Wiz’s analysis reveals the flaw affects 37% of cloud environments. In shared hardware environments, attackers could potentially access, steal, or manipulate sensitive data and proprietary AI models belonging to other customers using just three lines of code.

## How the Attack Works

The vulnerability stems from a misconfiguration in the toolkit’s handling of the Open Container Initiative (OCI) “createContainer” hook. Attackers can exploit this by:

1. Setting LD_PRELOAD in their Dockerfile
2. Instructing the nvidia-ctk hook to load a malicious library
3. Executing the attack from the container’s root filesystem

Wiz researchers Nir Ohfeld and Shir Tamari described the exploit as “stunningly simple,” requiring only a three-line Dockerfile to achieve complete server takeover.

## Broader Security Implications

This discovery follows previous NVIDIA Container Toolkit vulnerabilities (CVE-2024-0132 and CVE-2025-23359) that Wiz identified months earlier. The pattern highlights a critical security concern in AI infrastructure.

“While AI security discussions often focus on futuristic threats, traditional infrastructure vulnerabilities in the expanding AI technology stack pose immediate risks that security teams must prioritize,” Wiz stated.

## Security Recommendations

The research underscores that containers alone provide insufficient security isolation, particularly in multi-tenant environments. Security experts recommend implementing additional isolation barriers, such as virtualization, and adopting an “assume breach” mentality when designing applications.

Organizations using affected NVIDIA tools should immediately update to the patched versions to protect their AI infrastructure from potential attacks.