Information Disclosure Vulnerability in NVIDIA DGX Spark GB10
CVE-2025-33196

4.4MEDIUM

Key Information:

Vendor

Nvidia
Status
Dgx Spark
Vendor
CVE Published:
25 November 2025

What is CVE-2025-33196?

The NVIDIA DGX Spark GB10 has a security flaw in its SROOT firmware that could enable an attacker to make unauthorized access to sensitive data through resource reuse. If leveraged successfully, this vulnerability could result in the exposure of confidential information, posing a significant risk to data integrity and privacy.

Affected Version(s)

DGX Spark NVIDIA DGX OS All versions prior to OTA0

References

https://nvd.nist.gov/vuln/detail/CVE-2025-33196
https://www.cve.org/CVERecord?id=CVE-2025-33196
https://nvidia.custhelp.com/app/answers/detail/a_id/5720

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-33196 : Information Disclosure Vulnerability in NVIDIA DGX Spark GB10