NVIDIA DGX Spark GB10 Vulnerability in SROOT Firmware
CVE-2025-33197

4.3MEDIUM

Key Information:

Vendor

Nvidia
Status
Dgx Spark
Vendor
CVE Published:
25 November 2025

What is CVE-2025-33197?

The NVIDIA DGX Spark GB10 exhibits a vulnerability in its SROOT firmware that could be exploited by an attacker to cause a NULL pointer dereference. This situation may result in service interruptions, impacting the availability of the system. Organizations using the affected product should assess their exposure and apply appropriate mitigations.

Affected Version(s)

DGX Spark NVIDIA DGX OS All versions prior to OTA0

References

https://nvd.nist.gov/vuln/detail/CVE-2025-33197
https://www.cve.org/CVERecord?id=CVE-2025-33197
https://nvidia.custhelp.com/app/answers/detail/a_id/5720

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-33197 : NVIDIA DGX Spark GB10 Vulnerability in SROOT Firmware