CVE-2025-23266: NVIDIA Container Escape in Three Lines of Dockerfile

On July 18, 2025, Wiz researchers Nir Ohfeld and Shir Tamari published their analysis of CVE-2025-23266, a critical vulnerability in the NVIDIA Container Toolkit that allows an attacker to break container-to-host isolation with a three-line Dockerfile. The flaw directly impacts multi-tenant AI infrastructure, where tenant separation often relies solely on the container perimeter.

The Mechanism: A Privileged Hook That Reads from the Container Filesystem

The vulnerability stems from an architectural choice in the NVIDIA Container Toolkit. When the containerd or Docker runtime starts a container with GPU support, the toolkit's createContainer hook executes with elevated privileges on the host node. According to the Wiz analysis, this hook sets the container's root filesystem as its working directory during initialization.

This configuration allows an attacker who controls the container image content to place a malicious shared library in a predictable path and force its loading via the LD_PRELOAD environment variable. The attacker's code executes in the context of a privileged process on the host, with full ability to compromise the entire node.

"By setting LD_PRELOAD in their Dockerfile, an attacker could instruct the nvidia-ctk hook to load a malicious library" — Nir Ohfeld and Shir Tamari, Wiz

The researchers demonstrated that the exploit requires just three lines in the Dockerfile: one to copy the malicious library into the image, one to set the environment variable, and the automatic hook loading. The simplicity is functional to the nature of the problem: no sophisticated exploit chain is needed when the architecture itself provides the privileged execution channel.

Wiz's Estimate: A Problem of Scale, Not Theory

The Wiz analysis, cited by The Hacker News, estimates that approximately 37% of cloud environments are exposed to this vulnerability. The dossier does not specify the exact sampling methodology or inclusion criteria used for this estimate. It remains, however, an indicative figure of the NVIDIA Container Toolkit's prevalence in AI infrastructure, where the component is practically ubiquitous in deployments using GPUs for training and inference.

The multi-tenant nature of cloud AI platforms amplifies the risk. A tenant with legitimate access to a GPU container can theoretically compromise the underlying physical node, gaining access to data, models, and workloads of other tenants on the same machine. The source does not document confirmed incidents of this type nor in-the-wild attacks, but the threat model is technically valid and immediately exploitable.

A Recurring Pattern Questioning the NVIDIA Software Stack

CVE-2025-23266 is not an isolated case. In the same component, within less than a year, CVE-2024-0132 with an identical CVSS 9.0 score and CVE-2025-23359 with CVSS 8.3 have been recorded. The recurrence of critical flaws in the same attack surface — the container initialization path for GPUs — raises questions about the security posture of the software stack underpinning much of global cloud AI.

In technical detail, CVE-2024-0132 presented a different vector (network-based with user interaction, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) but identical severity, while CVE-2025-23359 has a slightly narrower attack profile (network, high complexity, CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). The three vulnerabilities are not equivalent in mechanism, but they share a location in an infrastructure component that many operators treat as opaque and trustworthy.

"While the hype around AI security risks tends to focus on futuristic, AI-based attacks, 'old-school' infrastructure vulnerabilities in the ever-growing AI tech stack remain the immediate threat that security teams should prioritize" — Wiz

The Wiz researchers' observation has an operational corollary: discussions on AI security tend to polarize around speculative risks — model manipulation, hallucinations, adversarial attacks — while the infrastructures hosting and serving these models present classic, often trivial-to-exploit vulnerabilities with systemic impact.

What to Do Now

Sources converge on an immediate mitigation path, with some technical specifics documented by Fidelis Security in support of the NVIDIA advisory:

• Update NVIDIA Container Toolkit to version 1.17.8 or later, and GPU Operator to 25.3.1 or later, as indicated in the official release notes cited by The Hacker News.
• If an immediate update is not feasible, Fidelis Security documents the option to disable the specific hook --disable-cuda-compat-lib-hook as a temporary mitigation, with verification of impact on workloads dependent on CUDA library compatibility.
• Review isolation architecture in multi-tenant GPU deployments: containers do not constitute an autonomous security barrier, and their compromise translates to host access in this specific scenario.
• Audit container images running on GPU nodes for undocumented LD_PRELOAD variables or shared libraries in anomalous paths in the root filesystem.

The source does not specify precise timestamps for the NVIDIA patch releases nor provide guidance on rollback procedures or post-update workload testing. The dossier also does not document specific detection measures to identify exploit attempts that may have already occurred.

The Shaky Foundation of Cloud AI

The lesson of NVIDIAScape transcends the single vulnerability. Cloud AI has been built on a software stack — container orchestrator, GPU runtime, vendor toolkit — that inherits security assumptions never verified under the pressure of massive, multi-tenant deployments. The ease of the exploit, three lines of Dockerfile, is inversely proportional to the sophistication of the infrastructure it compromises.

The Wiz researchers explicitly formulate a conclusion that many cloud operators have historically ignored: "containers are not a strong security barrier and should not be relied upon as the sole means of isolation." The realization becomes ungovernable when the failing container is the one that initializes GPU access underpinning the entire AI-as-a-service business model. Cloud AI security, in its current state, depends on the solidity of software components showing recurring failure patterns.

Information has been verified against cited sources and updated at time of publication.

Sources

• https://thehackernews.com/2025/07/critical-nvidia-container-toolkit-flaw.html
• https://fidelissecurity.com/vulnerabilities/cve-2025-23266/
• https://github.com/advisories/GHSA-vmg3-7v43-9g23
• https://fidelissecurity.com/threatgeek/
• https://fidelissecurity.com/service-support/
• https://fidelissecurity.com/solutions/