Out-of-Bound Write Vulnerability in NVIDIA DGX Spark GB10 Firmware
CVE-2025-33189

7.8HIGH

Key Information:

Vendor

Nvidia
Status
Dgx Spark
Vendor
CVE Published:
25 November 2025

What is CVE-2025-33189?

The NVIDIA DGX Spark GB10 firmware has a vulnerability that allows for an out-of-bound write, enabling potential attacks that could lead to various exploits. If successfully executed, these attacks can result in unauthorized code execution, data manipulation, denial of service, information exposure, or privilege escalation. Organizations using affected versions must prioritize updates and security measures to mitigate the risks associated with this vulnerability.

Affected Version(s)

DGX Spark NVIDIA DGX OS All versions prior to OTA0

References

https://nvd.nist.gov/vuln/detail/CVE-2025-33189
https://www.cve.org/CVERecord?id=CVE-2025-33189
https://nvidia.custhelp.com/app/answers/detail/a_id/5720

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-33189 : Out-of-Bound Write Vulnerability in NVIDIA DGX Spark GB10 Firmware