Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

NVIDIA Public Bug Bounty

By NVIDIA Bug bounty on Intigriti nvidia.com

Accepting reports Full safe harbor
Go to program
Top reward
$15,000
Top severity paid
Critical
Assets in scope
11
Public CVEs
0
Last change

At a glance

What to know before you start testing.

Pays up to $15,000
for critical bugs, from $150.
Report on Intigriti
Submit through the program page.
Full safe harbor
Good-faith research is authorised; no legal action.
No public write-ups
Keep findings private.

Rewards

What Intigriti lists as the payout for each severity.

Severity Reward
Critical $15,000 from $5,000
High $4,000 from $1,250
Medium $2,000 from $750
Low $300 from $150

Scope

11 assets you may test.

Web 1

  • CUDA Runtime APIs

Products and areas 10

  • All Other NVIDIA Container Toolkit Assets
  • CUDA Driver APIs
  • CUDA Libraries
  • libNVVM API
  • new CDI-based architecture
  • Nsight Systems
  • NVCC
  • NVIDIA Nsight Developer Tools
  • nvJitLink APIs
  • NVRTC library

Rules

What the policy asks of you, and the bug types it won't reward, quoted from NVIDIA Public Bug Bounty (via Intigriti)'s policy.

While testing

  • Respect the scope of the program
  • Not discuss or disclose vulnerability information without prior written consent (including PoC's on YouTube and Vimeo)
  • Always assume local access is required when evaluating vulnerabilities (Please set the CVSS attack vector to `Local`).
  • You may not participate in this program if you are ordinarily resident in, or located in, any country or region subject to comprehensive sanctions

Not accepted

  • Null pointer issues
  • Spam, social engineering and physical intrusion
  • DoS/DDoS attacks or brute force attacks
  • Vulnerabilities that only work on software that no longer receive security updates
  • Attacks requiring physical access to a victim's computer/device, man in the middle or compromised user accounts
  • Reports that state that software is out of date/vulnerable without a proof-of-concept
  • Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited
  • Making a program crash with a malformed input is not enough.

Summarised with AI from the program policy on Intigriti, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 11 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Status

    Program status changed

  2. Status

    Program status changed

  3. Status

    Program status changed

  4. Status

    Program status changed

  5. Status

    Program status changed

  6. Status

    Program status changed

  7. Status

    Program status changed

  8. Status

    Program status changed

  9. Status

    Program status changed

  10. Status

    Program status changed

  11. Status

    Program status changed

  12. Status

    Program status changed

  13. Status

    Program status changed

  14. Status

    Program status changed

  15. Status

    Program status changed

  16. Status

    Program status changed

  17. Scope removed

    CUDA Runtime APIs

  18. Scope removed

    NVIDIA Nsight Developer Tools

  19. Scope removed

    new CDI-based architecture

  20. Scope removed

    Nsight Systems

  21. Scope removed

    CUDA Driver APIs

  22. Scope removed

    All Other NVIDIA Container Toolkit Assets

  23. Scope removed

    CUDA Libraries

  24. Scope removed

    NVRTC library

  25. Scope removed

    libNVVM API

  26. Scope removed

    nvJitLink APIs

  27. Scope removed

    NVCC

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from www.intigriti.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Description

Welcome to the NVIDIA Public Bug Bounty Program

Thank you for your interest in helping us protect our products and users. We deeply value the security research community and appreciate the time, effort, and creativity you bring to making technology safer for everyone. Your contributions play an essential role in strengthening the trust our users place in NVIDIA.

Rules of engagement

By participating in this program, you agree to:

  • Respect the Community Code of Conduct
  • Respect the Intigriti Terms and Conditions
  • You may not participate in this program if you are ordinarily resident in, or located in, any country or region subject to comprehensive sanctions, or if you are an individual or entity identified on any applicable sanctions list (including those administered by OFAC, the EU, the UN, or the UK's OFSI).
  • Respect the scope of the program
  • Not discuss or disclose vulnerability information without prior written consent (including PoC's on YouTube and Vimeo)

In scope

Container Toolkit Scope

The implementation using the NVIDIA Container Runtime Hook, NVIDIA Container CLI, and NVIDIA Container Library is considered deprecated and is effectively in maintenance mode. With this in mind, although critical vulnerabilities in this stack will be addressed, focus on the new CDI-based architecture is appreciated.

CUDA Toolkit Scope

Focus areas and Special Interests

  • We are specifically looking for vulnerabilities which include local privilege escalation.
  • The CUDA Toolkit includes software that is run only by CUDA developers (such as the nvcc compiler) and software that runs as part of a CUDA program deployed to users (such as libraries linked into CUDA programs). Vulnerabilities that impact users of CUDA programs are more valuable than those which only impact developers. A bug that requires the presence of the nvcc compiler is less valuable than one that impacts any CUDA binary built with CUDA libraries.
  • We are looking for proof that you can use a bug to gain privilege. Making a program crash with a malformed input is not enough. We want to see that you can use the bug to execute code at a higher level of privilege than the user running the tool. For example, running code as a superuser or making the kernel driver take malicious action.
  • As of July 1, 2025 GMT: DLL Highjacking related vulnerabilities will be classified as Tier 3 submissions

Out of scope

Container Toolkit Out of Scope

The following are known, intended, or non-security behaviors and will be closed as informative:

  1. Annotation-driven CDI device injection. CDI device requests supplied via container/pod annotations (e.g. cdi.k8s.io/, nvidia.cdi.k8s.io/) are evaluated by design and are not gated by accept-nvidia-visible-devices-envvar-when-unprivileged, which applies only to the environment variable path. Container runtimes can perform CDI injection from annotations without involving the toolkit at all. Restricting which workloads may set these annotations is the cluster operator's admission-control responsibility. The namespace check in the NRI plugin scopes management device requests only and is not a tenant-isolation control.
  2. Findings that presuppose privileges the attacker already holds. Reports whose preconditions require control of the low-level runtime, its working directory, the OCI bundle, the container runtime configuration, or the ability to start containers with the NVIDIA runtime. No additional privilege boundary is crossed from these positions.
  3. Host GPU visibility or state from containers granted GPU access. A container explicitly given GPU devices (e.g. --gpus all) has intended access to the device nodes, NVML, and the persistence daemon socket. Host PID disclosure via NVML, GPU telemetry, persistence-mode changes, and daemon socket reachability are inherent to that access. GPUs are not namespace-aware; the toolkit does not claim to isolate GPU state from containers holding the device.
  4. Functional and specification-conformance gaps with no security impact. Behaviors that deviate from documented or expected functionality but cross no privilege boundary — including incorrect handling of NVIDIA_VISIBLE_DEVICES=none on specific code paths, and OCI spec conformance issues. Please report these as GitHub issues instead.
  5. Unreleased code. Findings against main, development branches, or pre-release builds. Only released versions are in scope.
  6. Memory-safety defects without demonstrated impact. Out-of-bounds reads/writes that remain within the enclosing allocation, uninitialized variables, null-pointer dereferences reachable only from host-trusted input, and compiler or static-analysis warnings without a demonstrated exploitable condition. These are welcome as GitHub issues.
  7. Theoretical or "one refactor away" findings. Reports where the input is host-trusted as deployed and exploitability depends on hypothetical future code changes.

CUDA Toolkit Out of Scope

Asset Specific

  • Null pointer issues
  • Compiler Object Tools are not included in the compiler threat model, as they are not directly involved in the CUDA compilation flow. These are standalone development and diagnostic tools. Achieving an ACE on these tools does not have any security impact on the CUDA Toolkit or the compilers.

General

  • In case that a reported vulnerability was already known to the company from their own tests, it will be flagged as a duplicate
  • Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited
  • Spam, social engineering and physical intrusion
  • DoS/DDoS attacks or brute force attacks
  • Vulnerabilities that only work on software that no longer receive security updates
  • Attacks requiring physical access to a victim's computer/device, man in the middle or compromised user accounts
  • Recently discovered zero-day vulnerabilities found in in-scope assets within 14 days after the public release of a patch or mitigation may be reported, but are usually not eligible for a bounty
  • Reports that state that software is out of date/vulnerable without a proof-of-concept

Severity

This program follows Intigriti's triage standards based on the proof of concept.

FAQ

Please select one of the sections below and remove the sections that aren't applicable for you

Where can we get credentials for Container Toolkit?

Where can we get credentials for CUDA Toolkit?

Which Attack Vector Should be used in the CVSS Calculation?

  • Always assume local access is required when evaluating vulnerabilities (Please set the CVSS attack vector to Local).
  • Due to the nature of the CVSS calculator, vulnerabilities in that case can only reach a max severity of 9.3.
  • As a result, exceptional and critical vulnerabilities within this program are eligible for the same bounty payout.