NVIDIA Container Toolkit Flaw Enables Root-Level Container Escape
Summary
Wiz researchers detail CVE-2025-23266, a critical NVIDIA Container Toolkit flaw that lets a malicious container escape to host root through an OCI hook. Affected versions include NCT through 1.17.7; NVIDIA recommends upgrading or disabling the hook.
Key points
- Wiz Research disclosed CVE-2025-23266, rated CVSS 9.0, in the NVIDIA Container Toolkit; the researchers say it can let a malicious container gain root access to the host.
- The flaw affects NVIDIA Container Toolkit versions through 1.17.7 and NVIDIA GPU Operator versions through 25.3.1; versions before NCT 1.17.5 are affected in CDI mode only.
- The exploit abuses a createContainer OCI hook that runs as a privileged host process and inherits environment variables from the container image.
- Setting LD_PRELOAD in the image can make the hook load an attacker-controlled shared library from the container filesystem, enabling escape with a simple Dockerfile.
- The researchers warn that shared GPU infrastructure could expose other customers’ data or models if a malicious container escapes; this is a potential impact, not a reported breach.
- NVIDIA recommends upgrading. As a temporary mitigation, administrators can disable the enable-cuda-compat hook; GPU Operator users on versions before 25.3.1 can deploy NCT 1.17.8.
- Wiz advises prioritizing hosts that run untrusted or public images; internet exposure is not required for exploitation.
Article Details
- Attack Vectors
- A malicious container image sets LD_PRELOAD to /proc/self/cwd/poc.so and includes poc.so; the NVIDIA Container Toolkit's privileged createContainer hook inherits the variable and loads the library from the container filesystem, enabling escape to host root.
- Potential initial access paths mentioned include social engineering against developers, supply-chain access to a container image repository, and environments that allow users to load arbitrary images.
- Defensive Notes
- Upgrade the NVIDIA Container Toolkit to the latest version; versions up to and including 1.17.7 are affected. NVIDIA GPU Operator versions up to and including 25.3.1 are also affected.
- Prioritize patching hosts likely to run untrusted or public container images, and use runtime validation to identify instances actively using the vulnerable toolkit.
- Internet exposure is not required for exploitation and is not a relevant prioritization factor.
- Where immediate upgrading is not possible, disable the enable-cuda-compat hook using disable-cuda-compat-lib-hook.
- Use a strong isolation barrier such as virtualization in multi-tenant environments; do not rely on containers as the sole isolation boundary.
MITRE ATT&CK
CVE
CVE-2024-0132time we've uncovered severe vulnerabilities in this core component. Last year, Wiz Research disclosed CVE-2024-0132, a similar container escape flaw that allowed for a full host takeover. These findings are part of ourCVE-2025-23266powers many AI services offered by cloud and SaaS providers, and the vulnerability, now tracked as CVE-2025-23266, has been assigned a CVSS score of 9.0 (Critical). It allows a malicious container to bypass
People
Andres RianchoNamed member of the Wiz Research team that reported and published the vulnerability research.Hillai Ben-SassonNamed member of the Wiz Research team that reported and published the vulnerability research.Nir OhfeldNamed member of the Wiz Research team that reported and published the vulnerability research.Ronen ShustinNamed member of the Wiz Research team that reported and published the vulnerability research.Sagi TzadikNamed member of the Wiz Research team that reported and published the vulnerability research.Yuval AvrahamiNamed member of the Wiz Research team that reported and published the vulnerability research.
Vendors
Products
Nvidia Container ToolkitWiz Research discovered a critical container escape vulnerability in the NVIDIA Container Toolkit (NCT), which we've dubbed #NVIDIAScape. This toolkit powers many AI services offered by cloud and SaaS providers, and theNVIDIA GPU OperatorNVIDIA GPU Operator: All versions up to and including 25.3.1
Tools
PEACH frameworkand implement at least one strong isolation barrier, such as virtualization (as explained in the PEACH framework). Wiz Research has written about this issue extensively, and you can read more about it in ourWiz Threat Intel CenterWiz customers can use this pre-built query in the Wiz Threat Intel Center to find vulnerable instances of the NVIDIA Container Toolkit in their environment.