NVIDIAScape - Critical NVIDIA AI Vulnerability: A Three-Line Container Escape in NVIDIA Container Toolkit (CVE-2025-23266)

New critical vulnerability with 9.0 CVSS presents systemic risk to the AI ecosystem, carries widespread implications for AI infrastructure.

Wiz Research discovered a critical container escape vulnerability in the NVIDIA Container Toolkit (NCT), which we've dubbed#NVIDIAScape. This toolkit powers many AI services offered by cloud and SaaS providers, and the vulnerability, now tracked asCVE-2025-23266, has been assigned aCVSS score of 9.0 (Critical). It allows a malicious container to bypass isolation measures and gain full root access to the host machine. This flaw stems from a subtle misconfiguration in how the toolkit handles OCI hooks, and it can be exploited with a stunningly simplethree-line Dockerfile.

Because the NVIDIA Container Toolkit is the backbone for many managed AI and GPU services across all major cloud providers, this vulnerability represents a systemic risk to the AI ecosystem, potentially allowing attackers to tear down the walls separating different customers, affecting thousands of organizations.

The danger of this vulnerability is most acute inmanaged AI cloud servicesthat allow customers to run their own AI containers on shared GPU infrastructure. In this scenario, a malicious customer could use this vulnerability to run a specially crafted container, escape its intended boundaries, and achieve full root control of the host machine. From there, the attacker couldaccess, steal, or manipulate the sensitive data and proprietary models of all other customersrunning on the same shared hardware.

This is exactly the class of vulnerability that has proven to be a systemic risk across the AI cloud. A few months ago, Wiz Researchdemonstratedhow similar container escape flaws allowed access to sensitive customer data in major services likeReplicate and DigitalOcean. The recurrence of these fundamental issues highlights the urgent need to scrutinize the security of our core AI infrastructure as the world races to adopt it.

NVIDIA Container Toolkit: All versions up to and including v1.17.7 (CDI mode only for versions prior to 1.17.5)

NVIDIA GPU Operator: All versions up to and including 25.3.1

The primary recommendation is toupgrade to the latest version of the NVIDIA Container Toolkitas advised in theNVIDIA security bulletin.

Wiz customers can use thispre-built queryin theWiz Threat Intel Centerto find vulnerable instances of the NVIDIA Container Toolkit in their environment.

Patching is highly recommended for all container hosts running vulnerable versions of the toolkit. Since the exploit is delivered inside the container image itself, We advise prioritizing hosts that are likely to run containers built from untrusted or public images.Further prioritization can be achieved through runtime validation to focus patching efforts on instances where the vulnerable toolkit is actively in use.

It is important to note that internet exposure is not a relevant factor for triaging this vulnerability.The affected host does not need to be publicly exposed. Instead, initial access vectors may include social engineering attempts against developers, supply chain scenarios where an attacker has prior access to a container image repository, or any environment that allows users to load arbitrary images.

For systems that cannot be immediately upgraded, NVIDIA has provided several mitigation options. The primary method is to opt out of using theenable-cuda-compathook, which is the source of the exposure.

When using the NVIDIA Container Runtime in legacy mode, you can disable the hook by editing the/etc/nvidia-container-toolkit/config.tomlfile and setting thefeatures.disable-cuda-compat-lib-hookflag totrue:

When using the NVIDIA GPU Operator, you can disable the hook by addingdisable-cuda-compat-lib-hookto theNVIDIA_CONTAINER_TOOLKIT_OPT_IN_FEATURESenvironment variable. This can be done by including the following arguments when installing or upgrading the GPU Operator with Helm:

Note: Any other feature flags should be added as a comma-separated list to thevaluefield.

For users with aGPU Operator version prior to 25.3.1, you can deploy the patched NVIDIA Container Toolkit version1.17.8by including the following arguments in your Helm command:

Note: For Red Hat Enterprise Linux or Red Hat OpenShift, you must specify thev1.17.8-ubi8tag.

The entire AI revolution is built on the power of NVIDIA GPUs. In the cloud, the critical component that securely connects containerized applications to these GPUs is the NVIDIA Container Toolkit.

This is not the first time we've uncovered severe vulnerabilities in this core component. Last year, Wiz Research disclosedCVE-2024-0132, a similar container escape flaw that allowed for a full host takeover. These findings are part of our ongoing research into the security of the AI supply chain. We are investigating every layer of the AI stack, from the infrastructure (Hugging Face,Replicate,SAP AI Core) to the models themselves and the software used to run them (Ollama), to understand the real-world risks as the world races to adopt this new technology.

The path to this container escape lies not in a complex memory corruption bug, but in the subtle interplay between the container specification, a trusted host component, and a classic Linux trick. Understanding the exploit requires looking at three key parts: the OCI hook mechanism, the specific flaw in NVIDIA's implementation, and the weaponization of that flaw.

The Open Container Initiative (OCI) specification defines a standard for container runtimes. Part of this standard is a "hook" system, which allows tools to run scripts at specific points in a container's lifecycle. TheNVIDIA Container Toolkit (NCT)uses these hooks to perform its primary function: configuring a container to be able to communicate with the host's NVIDIA drivers and GPUs.

When a container is started with the NVIDIA runtime, the NCT registers several hooks, including the followingcreateContainerhook:

This hook runs as a privileged process on the host to set up the necessary environment for the container.

The OCI spec defines different types of hooks. Whileprestarthooks run in a clean, isolated context,createContainerhooks have a critical property:they inherit environment variables from the container image unless explicitly configured not to

According to the OCI specification onGithub:

“… on Linux this would happen before thepivot_rootoperation is executed but after the mount namespace was created and setup.”.

With the ability to control the environment of the privileged hook, an attacker has many options. One of the most direct is to abuseLD_PRELOAD, a well-known and powerful Linux environment variable.LD_PRELOADforces a process to load a specific user-defined shared library (.sofile).

By settingLD_PRELOADin their Dockerfile, an attacker could instruct thenvidia-ctkhook to load a malicious library. Making matters worse, thecreateContainerhook executes with its working directory set to the container's root filesystem. This means the malicious library can be loaded directly from the container image with a simple path, completing the exploit chain.

One of the most alarming aspects of this vulnerability is its simplicity. An attacker only needs to build a container image with a malicious payload and the following three-line Dockerfile.

When this container is run on a vulnerable system, thenvidia-ctk createContainerhook inherits theLD_PRELOADvariable. Since the hook's working directory is the container's filesystem, it loads the attacker'spoc.sofile into its own privileged process, instantly achieving a container escape.

To prove this, ourpoc.sopayload simply runs the id command and writes the output to/ownedon the host.

May 17, 2025:Initial vulnerability report sent to NVIDIA in Pwn2Own Berlin.

July 15, 2025:NVIDIA published the security bulletin and assigned CVE-2025-23266.

July 17, 2025:Wiz Research publishes this blog post.

When discussing AI security, this vulnerability once more highlights that the most real and immediate risk to AI applications today comes from their underlying infrastructure and tooling. While the hype around AI security risks tends to focus on futuristic, AI-based attacks, “old-school” infrastructure vulnerabilities in the ever-growing AI tech stack remain the immediate threat that security teams should prioritize.

This practical attack surface is the result of the fast-paced introduction of new AI tools and services. It is therefore vital that security teams work closely with their AI engineers to gain visibility into the architecture, tooling, and AI models being used. Specifically, as this vulnerability demonstrates, it is important to build a mature pipeline for running AI models with full control over their source and integrity.

Additionally, this research highlights, not for the first time, thatcontainers are not a strong security barrier and should not be relied upon as the sole means of isolation.When designing applications, especially for multi-tenant environments, one should always “assume a vulnerability” and implement at least one strong isolation barrier, such as virtualization (as explained in thePEACH framework). Wiz Research has written about this issue extensively, and you can read more about it in our previous research onAlibaba Cloud,IBM,Azure,Hugging Face,Replicate, andSAP.

Hi there! We are Nir Ohfeld (@nirohfeld), Sagi Tzadik (@sagitz_), Ronen Shustin (@ronenshh), Hillai Ben-Sasson (@hillai), Andres Riancho (@andresriancho) and Yuval Avrahami (@yuvalavra) from the Wiz Research Team (@wiz_io). We are a group of veteran white-hat hackers with a single goal: to make the cloud a safer place for everyone. We primarily focus on finding new attack vectors in the cloud and uncovering isolation issues in cloud vendors and service providers. We would love to hear from you! Feel free to contact us on X (Twitter) or via email: [email protected].

See how Wiz protects your cloud from code to runtime

Improve security posture and remediate risks faster using natural language workflows.

What our customers say: Wiz named as a Gartner Customers’ Choice for CSPM

AI accelerates development— and risk shouldn't be a blocker to innovation. Bridging AppSec and CloudSec with shared context and workflows is key to keeping up.

Get a personalized demo

©2026Wiz, Inc.

StatusPrivacy PolicyTerms of UseModern Slavery StatementCookie Settings