NVIDIA CUDA‑Q is vulnerable to an out‑of‑bounds read that occurs when an unauthenticated requester sends a specially crafted message to an exposed endpoint. The flaw allows the attacker to read memory locations outside the intended buffer, potentially revealing sensitive data and disrupting application stability. This weakness is classified as CWE‑125 and can lead to both denial of service and information disclosure.

The vulnerability affects NVIDIA’s CUDA‑Q product. Specific version details are not provided in the data, so all releases of CUDA‑Q could be impacted. Users should verify their installed CUDA‑Q variants against vendor advisories and update when a fix is released.

The CVSS score of 8.2 indicates high severity, and the lack of an EPSS score means exploitation probability is unknown. The vulnerability is listed as not present in the CISA KEV catalog. Attackers would need only network access to the vulnerable endpoint; no authentication is required, making the attack vector readily exploitable if the endpoint is exposed.