NVIDIA Nsight Systems for Linux contains a vulnerability in the .run installer, where an attacker could cause an OS command injection by supplying a malicious string to the installation path. A successful exploit of this vulnerability might lead to escalation of privileges, code execution, data tampering, denial of service, and information disclosure.
NVIDIA Nsight Visual Studio for Windows contains a vulnerability in Nsight Monitor where an attacker can execute arbitrary code with the same privileges as the NVIDIA Nsight Visual Studio Edition Monitor application. A successful exploit of this vulnerability may lead to escalation of privileges, code execution, data tampering, denial of service, and information disclosure.
NVIDIA Nsight Systems contains a vulnerability in the gfx_hotspot recipe, where an attacker could cause an OS command injection by supplying a malicious string to the process_nsys_rep_cli.py script if the script is invoked manually. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.
CVE-2025-33233 is a high-severity code injection vulnerability in NVIDIA Merlin Transformers4Rec affecting all versions prior to commit 27ddd49. It allows an attacker with local privileges and low complexity to execute arbitrary code without user interaction, potentially leading to privilege escalation, information disclosure, and data tampering. The vulnerability arises from improper control over code generation (CWE-94). Although no known exploits are currently in the wild, the impact on confidentiality, integrity, and availability is high. European organizations using Merlin Transformers4Rec in AI/ML recommendation systems should prioritize patching or mitigating this flaw. Countries with significant AI technology adoption and NVIDIA product usage, such as Germany, France, and the UK, are most at risk. Mitigation involves applying the fixed commit, restricting local access, and auditing code inputs. Given the CVSS 7.8 score, the threat is classified as high severity.
NVIDIA NSIGHT Graphics for Linux contains a vulnerability where an attacker could cause command injection. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and denial of service.
NVIDIA Isaac Launchable contains a vulnerability where an attacker could exploit a hard-coded credential issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, and data tampering.
NVIDIA Isaac Launchable contains a vulnerability where an attacker could cause an execution with unnecessary privileges. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure and data tampering.
NVIDIA Isaac Launchable contains a vulnerability where an attacker could cause an execution with unnecessary privileges. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure and data tampering.
CVE-2025-33235 is a high-severity race condition vulnerability in the NVIDIA Resiliency Extension for Linux, specifically in its checkpointing core. This flaw allows an attacker with limited privileges and local access to exploit improper synchronization of shared resources, potentially leading to information disclosure, data tampering, denial of service, or privilege escalation. The vulnerability affects versions prior to 0.5.0 and 0.4.1. Exploitation does not require user interaction but does require local access with some privileges. No known exploits are currently in the wild. European organizations using NVIDIA Resiliency Extension in Linux environments should prioritize patching once updates are available and implement strict access controls to mitigate risk.
CVE-2025-33225 is a high-severity vulnerability in the NVIDIA Resiliency Extension for Linux, affecting versions prior to 0.5.0. It involves a symbolic link (symlink) following weakness in log aggregation, where attackers can predict log file names. Exploiting this flaw can lead to privilege escalation, arbitrary code execution, denial of service, information disclosure, and data tampering without requiring user interaction or prior authentication. The vulnerability has a CVSS score of 8.4, indicating significant risk. No known exploits are currently reported in the wild. European organizations using NVIDIA Resiliency Extension in Linux environments should prioritize patching once available and implement strict file system permissions and monitoring to mitigate risks. Countries with strong tech sectors and high adoption of NVIDIA products, such as Germany, France, and the UK, are most likely to be affected.
CVE-2025-33210 is a critical deserialization vulnerability in NVIDIA Isaac Lab versions prior to 2.3.0. Exploiting this flaw allows an attacker with limited privileges and requiring user interaction to execute arbitrary code, impacting confidentiality, integrity, and availability. The vulnerability arises from unsafe deserialization of untrusted data (CWE-502). Although no known exploits are currently in the wild, the high CVSS score (9.0) indicates severe risk. European organizations using NVIDIA Isaac Lab, especially in robotics and AI research sectors, face significant threats. Mitigation requires upgrading to version 2.3.
NVIDIA NeMo Framework for all platforms contains a vulnerability where malicious data created by an attacker may cause a code injection. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.
NVIDIA NeMo Framework contains a vulnerability in model loading that could allow an attacker to exploit improper control mechanisms if a user loads a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, and data tampering.
CVE-2025-33214 is a high-severity deserialization vulnerability in NVIDIA NVTabular's Workflow component on Linux. It allows remote attackers to execute arbitrary code, cause denial of service, disclose sensitive information, or tamper with data by exploiting untrusted data deserialization. The vulnerability requires no privileges but does require user interaction. All NVTabular versions prior to the commit 5dd11f4 are affected. Although no known exploits are currently in the wild, the CVSS score of 8.8 indicates a serious risk. European organizations using NVTabular for data processing or machine learning workflows should prioritize patching. Countries with significant AI and data science sectors and NVIDIA product adoption are at higher risk. Immediate mitigation involves updating NVTabular to include the fixed commit and restricting untrusted input to the Workflow component.
CVE-2025-33213 is a high-severity vulnerability in NVIDIA Merlin Transformers4Rec's Trainer component on Linux, involving deserialization of untrusted data (CWE-502). Exploiting this flaw could allow remote attackers to execute arbitrary code, cause denial of service, disclose sensitive information, or tamper with data. The vulnerability affects all versions prior to a specific commit (876f19e) and requires user interaction but no privileges. Although no known exploits are currently in the wild, the CVSS score of 8.8 indicates significant risk. European organizations using Merlin Transformers4Rec in AI/ML workflows should prioritize patching and implement strict input validation and network segmentation. Countries with strong AI research and industries relying on NVIDIA AI tools, such as Germany, France, and the UK, are most likely to be impacted. Immediate mitigation steps include updating to the fixed version, restricting Trainer component access, and monitoring for suspicious activity.
CVE-2025-33208 is a high-severity vulnerability in NVIDIA TAO version 6.25.7 involving an uncontrolled search path element (CWE-427). This flaw allows an attacker to influence resource loading paths, potentially leading to privilege escalation, data tampering, denial of service, and information disclosure. Exploitation requires no privileges but does require user interaction. The vulnerability impacts confidentiality, integrity, and availability with a CVSS score of 8.8. No known exploits are currently reported in the wild. European organizations using NVIDIA TAO, especially in AI and machine learning deployments, should prioritize patching and implement strict path validation controls. Countries with significant AI research and technology sectors, such as Germany, France, and the UK, are most likely to be affected.
NVIDIA Triton Server for Linux contains a vulnerability where an attacker may cause an improper validation of specified quantity in input. A successful exploit of this vulnerability may lead to denial of service.
NVIDIA Triton Inference Server contains a vulnerability where an attacker may cause an improper check for unusual or exceptional conditions issue by sending extra large payloads. A successful exploit of this vulnerability may lead to denial of service.
NVIDIA NeMo Agent Toolkit UI for Web contains a vulnerability in the chat API endpoint where an attacker may cause a Server-Side Request Forgery. A successful exploit of this vulnerability may lead to information disclosure and denial of service.
NVIDIA NeMo framework contains a vulnerability in a predefined variable, where an attacker could cause inclusion of functionality from an untrusted control sphere by use of a predefined variable. A successful exploit of this vulnerability may lead to code execution.
