Memory Buffer Vulnerability in NVIDIA DGX Spark GB10 Firmware
CVE-2025-33195

4.4MEDIUM

Key Information:

Vendor

Nvidia
Status
Dgx Spark
Vendor
CVE Published:
25 November 2025

What is CVE-2025-33195?

The NVIDIA DGX Spark GB10 firmware contains a vulnerability associated with SROOT firmware that can lead to unintended memory buffer operations. This flaw may be exploited by attackers to manipulate data, disrupt services, or achieve unauthorized privilege escalation, posing significant risks to system integrity and availability.

Affected Version(s)

DGX Spark NVIDIA DGX OS All versions prior to OTA0

References

https://nvd.nist.gov/vuln/detail/CVE-2025-33195
https://www.cve.org/CVERecord?id=CVE-2025-33195
https://nvidia.custhelp.com/app/answers/detail/a_id/5720

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.