The VIRTIO-BLK component in NVIDIA SNAP-4 Container allows a malicious guest virtual machine to send specially crafted messages that cause an out-of-range pointer offset. This out-of-bounds memory access can break the Direct Physical Access mechanism, leading to a denial of service that affects storage availability for other virtual machines. The flaw is an example of an out-of-bounds memory error (CWE-823) that can result in loss of availability for the hosting system’s storage services.

The vulnerability affects NVIDIA SNAP-4 Container environments. No specific version range is listed, so all current releases of the container are potentially vulnerable unless NVIDIA publishes a fixed release. No other vendor or product mentions appear in the advisory.

The CVSS score of 6.8 indicates moderate severity. EPSS data is unavailable and the issue does not appear in the CISA KEV catalog, suggesting it is not widely exploited at present. The likely attack vector is local to the host, requiring a malicious guest VM with privileged access to the VIRTIO‑BLK device. Once triggered, the denial of service can disrupt storage for all VMs sharing the same host, but remote exploitation appears unlikely based on the description. The threat concentrates in environments where guest VMs can freely interact with the vulnerable component.