NVIDIA CUDA Toolkit SDK contains an integer overflow vulnerability in cuobjdump.To exploit this vulnerability, a remote attacker would requ…

published 2022-03-29 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-26981

cvss: 7.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 2.1%; EPSS 2.1% chance of exploitation in 30 days, percentile 81%
public exploits: 0; none known

NVIDIA CUDA Toolkit SDK contains an integer overflow vulnerability in cuobjdump.To exploit this vulnerability, a remote attacker would require a local user to download a specially crafted, corrupted file and locally execute cuobjdump against the file. Such an attack may lead to remote code execution that causes complete denial of service and an impact on data confidentiality and integrity.

Patch / fix

fixed in 1 distros 1

nvidia cuda_toolkit 11.6.2

nvidia-cuda-toolkit Debian 13, Debian 12 11.6.2-2

debian advisories DEBIAN-CVE-2022-21821

Exploit prediction

2.09% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

NVIDIA NVIDIA CUDA Toolkit

Classification

Weakness

CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input
CWE-190 Integer Overflow or Wraparound

References

nvidia.custhelp.com /app/answers/detail/a_id/5334
mitigation, vendor-advisory

Sources

CVE List CVE-2022-21821
NVD CVE-2022-21821

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary