Pathname Limitation Vulnerability in NVIDIA NeMo Framework
CVE-2025-23250

7.6HIGH

Key Information:

Vendor

Nvidia
Status
Nemo Framework
Vendor
CVE Published:
22 April 2025

What is CVE-2025-23250?

The NVIDIA NeMo Framework is susceptible to a vulnerability that allows attackers to bypass restrictions placed on pathnames, enabling arbitrary file writes. Exploitation of this flaw could result in unauthorized code execution and manipulation of data, posing significant risks to application integrity and security.

Affected Version(s)

NeMo Framework Windows All versions prior to 25.02

References

https://nvidia.custhelp.com/app/answers/detail/a_id/5641

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-23250 : Pathname Limitation Vulnerability in NVIDIA NeMo Framework