NVIDIAScape: Container Escape in Three Lines of Code in the…

CVE-2025-23266, rated CVSS 9.0, affects 37% of AI cloud environments. An old-school bug in the NVIDIA Container Toolkit enables privilege escalation and container escape.

On July 17, 2025, NVIDIA released patches for CVE-2025-23266, a critical vulnerability in the NVIDIA Container Toolkit with a CVSS score of 9.0 out of 10.0. Wiz researchers demonstrated that an attacker with container access can gain host privileges via a three-line Dockerfile, compromising isolation in multi-tenant AI cloud services.

Key Takeaways

CVE-2025-23266 (CVSS 9.0/10.0) affects NVIDIA Container Toolkit up to version 1.17.7 and GPU Operator up to 25.3.0; patched versions are 1.17.8 and 25.3.1, according to The Hacker News.
The exploit leverages the OCI createContainer hook, which executes with its working directory on the container's root filesystem and honors the LD_PRELOAD variable from the environment, loading malicious libraries into a privileged host process.
Wiz estimates that 37% of cloud environments are exposed to the vulnerability.
The GitHub Advisory Database classifies the flaw as CWE-426: Untrusted Search Path with impact on privilege escalation, data tampering, information disclosure, and denial-of-service.

The Mechanism: When LD_PRELOAD Becomes a Weapon

The core of the problem lies in the NVIDIA toolkit's createContainer hook. This hook, which the OCI (Open Container Initiative) framework invokes to initialize the GPU container runtime, has a critical configuration: its working directory is set to the container's root filesystem, not a host-controlled path.

According to Wiz researchers Nir Ohfeld and Shir Tamari, cited by The Hacker News, "the createContainer hook executes with its working directory set to the container's root filesystem." This means any shared library placed in the container image is immediately referenceable via relative paths.

The second link in the chain: the hook honors the LD_PRELOAD environment variable even when it originates from an untrusted container. "By setting LD_PRELOAD in their Dockerfile, an attacker could instruct the nvidia-ctk hook to load a malicious library," the Wiz researchers explain. The hook process runs with elevated privileges on the host; the loaded code inherits that context. The result is a full container escape.

The Banality of the Attack: Three Lines to Topple a Myth

The most unsettling dimension of the vulnerability is its technical triviality. No sophisticated exploit chains or memory corruption techniques are required: a three-line Dockerfile is sufficient to set LD_PRELOAD and place the malicious library in the correct path. This accessibility drastically lowers the barrier to attack, making the threat operational for a much wider range of threat actors.

"containers are not a strong security barrier and should not be relied upon as the sole means of isolation" — Wiz

Wiz's warning is not rhetorical. The 37% cloud exposure figure, reported by the same source, indicates the vulnerable configuration is widespread well beyond experimental deployments. In multi-tenant environments — where providers like AWS, Google Cloud Platform, and Microsoft Azure offer NVIDIA GPU instances to distinct customers — the flaw turns every container into a potential bridge to adjacent tenants' data and models.

The CWE-426 (Untrusted Search Path) classification in the GitHub Advisory Database confirms the structural nature of the defect: the software searches for critical resources using an externally supplied search path without validation. This is not a marginal implementation bug, but a violation of principle in the isolation architecture.

The AI Security Paradox: Futurism vs. Fundamentals

The AI industry devotes growing resources to speculative risk scenarios: adversarial attacks on models, LLM jailbreaks, sophisticated data poisoning. CVE-2025-23266 pulls attention back to a more prosaic and urgent plane. "While the hype around AI security risks tends to focus on futuristic, AI-based attacks, 'old-school' infrastructure vulnerabilities in the ever-growing AI tech stack remain the immediate threat that security teams should prioritize," Wiz observes.

The observation carries an operational corollary: AI stacks grow faster than their documented attack surface. The NVIDIA Container Toolkit is a standard component in thousands of MLOps pipelines; the GPU Operator is a ubiquitous Kubernetes deployment tool in enterprise AI clusters. A flaw in these infrastructure layers has a blast radius far greater than an isolated application vulnerability.

The case also recalls CVE-2024-0132, a previous vulnerability in the same toolkit with an identical CVSS 9.0 score. The recurrence of critical bugs with equivalent severity suggests the threat surface model of the NVIDIA GPU stack warrants systematic review, beyond point responses to individual advisories.

What to Do Now

Update NVIDIA Container Toolkit to version 1.17.8 or later and NVIDIA GPU Operator to version 25.3.1 or later, as indicated in their respective advisories.
Scan for unauthorized containers in GPU clusters running images with populated LD_PRELOAD environment variables; the exploit's simplicity makes post-compromise detection relevant.
Isolate multi-tenant GPU workloads with additional security boundaries (hypervisor, microVMs, or dedicated nodes for sensitive tenants), given that containers alone do not guarantee isolation against this class of vulnerability.
Review CI/CD pipelines that build GPU container images: the LD_PRELOAD variable in a Dockerfile should trigger mandatory review and automatic blocks unless explicitly justified.

Why This Case Marks a Turning Point

CVE-2025-23266 is not an exotic vulnerability. It is an untrusted search path bug in a system component, the kind that has existed since the days of Windows DLL hijacking. Its criticality derives from context: it sits at the heart of the cloud infrastructure powering the generative AI expansion.

The combination of massive exposure (37% of cloud), extreme severity (CVSS 9.0), and exploit triviality (three lines) creates a risk profile that organizations can no longer manage with reactive patch management. It demands a redesign of assumptions: the moment GPUs become shared resources across tenants, the container-as-security boundary proves insufficient. Wiz is right that containers should not be trusted as the sole means of isolation; the question is how many infrastructure operators have already internalized that reality.

Frequently Asked Questions

Which NVIDIA products are concretely affected?

The GitHub Advisory Database lists NVIDIA Container Toolkit and NVIDIA GPU Operator as affected products. Vulnerable versions are up to 1.17.7 and up to 25.3.0 respectively; patched versions are 1.17.8 and 25.3.1.

Is privileged container access required to exploit the flaw?

According to The Hacker News, the attacker must have the ability to run a container and set environment variables in the Dockerfile. The container escape occurs subsequently, elevating privileges beyond the container's own limits.

Is the vulnerability actively exploited?

The dossier does not document confirmed in-the-wild exploits. The danger remains high due to the proof-of-concept's triviality and the cloud exposure measured by Wiz.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references