CVE-2025-23356: NVIDIA Isaac Lab RCE Vulnerability

CVE-2025-23356 Overview

CVE-2025-23356 is a high-severity vulnerability in NVIDIA Isaac Lab affecting the Stable-Baselines3 (SB3) configuration parsing routine. The flaw stems from a missing authentication check on a critical function [CWE-306], allowing a local attacker to abuse the parser without prior privileges or user interaction. Successful exploitation can lead to code execution, denial of service, privilege escalation, information disclosure, or data tampering on the host running Isaac Lab. NVIDIA published guidance for the issue in its customer support portal.

Critical Impact
A local actor can fully compromise the confidentiality, integrity, and availability of an Isaac Lab workstation or training node by feeding it a crafted SB3 configuration.

Affected Products

NVIDIA Isaac Lab (SB3 configuration parser component)
Reinforcement learning workflows that consume SB3 configuration files in Isaac Lab
Workstations and training nodes running vulnerable Isaac Lab releases

Discovery Timeline

2025-10-14 - CVE-2025-23356 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-23356

Vulnerability Analysis

NVIDIA Isaac Lab is a GPU-accelerated robot learning framework built on Isaac Sim. It integrates with Stable-Baselines3 (SB3), a Python reinforcement learning library that consumes structured configuration objects to define agents, policies, and training environments. The vulnerability resides in the routine that loads and parses these SB3 configuration inputs.

Because the parser does not authenticate or validate the origin of configuration data before acting on it, an attacker who can place a malicious configuration file in a path Isaac Lab reads can trigger attacker-controlled behavior during parsing. NVIDIA states that exploitation may yield code execution, denial of service, escalation of privileges, information disclosure, or data tampering.

The attack vector is local, attack complexity is low, and no privileges or user interaction are required. Impact on confidentiality, integrity, and availability is high.

Root Cause

The root cause is a missing authentication check on a critical function [CWE-306]. The SB3 configuration parser trusts input that should be treated as untrusted, and it executes or instantiates objects described by that configuration without verifying the caller or the data source. Python configuration loaders that rely on dynamic class resolution or unsafe deserialization patterns are typical sources of this class of issue.

Attack Vector

An attacker with local access stages a crafted SB3 configuration file in a directory consumed by an Isaac Lab training or evaluation workflow. When Isaac Lab parses the configuration, the malicious directives are honored, granting the attacker code execution in the context of the Isaac Lab process. The attacker can then read training data, alter model artifacts, terminate long-running jobs, or pivot to higher privileges depending on how the process is launched.

No verified public proof-of-concept code is available. Refer to the NVIDIA Customer Support Article for vendor-supplied technical details.

Detection Methods for CVE-2025-23356

Indicators of Compromise

Unexpected child processes spawned by the Python interpreter running Isaac Lab during configuration load.
SB3 configuration files (.yaml, .json, .pkl) modified outside of normal change-control windows or originating from non-developer accounts.
Outbound network connections or shell invocations correlated with Isaac Lab startup but not present in known-good baselines.

Detection Strategies

Hash and version-pin authorized SB3 configuration files, then alert on any deviation in the Isaac Lab working tree.
Monitor Isaac Lab process trees for execution of interpreters, package managers, or system utilities that have no legitimate role in reinforcement learning workloads.
Inspect SB3 configuration files for embedded Python references, !!python/object YAML tags, or class paths outside an approved allowlist.

Monitoring Recommendations

Enable command-line and process-creation auditing on all hosts that run Isaac Lab and forward events to a centralized log platform.
Track file integrity on directories that hold training configurations, checkpoints, and policy artifacts.
Alert on privilege transitions originating from Isaac Lab user contexts, especially sudo or container-escape primitives.

How to Mitigate CVE-2025-23356

Immediate Actions Required

Apply the fix described in the NVIDIA Customer Support Article for CVE-2025-23356 as soon as it is available in your environment.
Restrict local interactive access to Isaac Lab workstations and training nodes to a small, audited set of accounts.
Treat all SB3 configuration files as code: store them in version control, require review, and deny writes from non-developer accounts.

Patch Information

NVIDIA has published remediation guidance through its support portal. Administrators should consult the NVIDIA Customer Support Article (Answer ID 5708) for the specific fixed versions and upgrade procedures for NVIDIA Isaac Lab.

Workarounds

Run Isaac Lab inside a hardened container with a non-root user, read-only mounts for configuration directories, and no outbound network egress beyond what training requires.
Validate SB3 configuration files against a strict schema before they reach Isaac Lab, rejecting any directive that resolves to arbitrary Python classes or callables.
Segregate research workstations from production identity and data planes so that local code execution cannot pivot into sensitive systems.

bash

# Configuration example: restrict who can write Isaac Lab SB3 configs
sudo chown -R isaaclab:isaaclab /opt/isaaclab/configs
sudo chmod -R 0750 /opt/isaaclab/configs
sudo find /opt/isaaclab/configs -type f -exec chmod 0640 {} \;