CVE-2025-33191

🔶 medium

Summary

NVIDIA DGX Spark GB10 contains a vulnerability in OSROOT firmware, where an attacker could cause an invalid memory read. A successful exploit of this vulnerability might lead to denial of service.

CVSS Score

5.7

Medium

EPSS Score

0.0

Exploit Probability

Published Date

2025-11-25

First Seen: 2026-01-05

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 32.9% of all 329,456 vulnerabilities in our database.

#221,102

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Nov 25, 2025

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

SSVC data provided by CISA

Last Modified 2025-12-02

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

CWE IDs (Weakness Types)

CWE-20

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
nvidia	dgx_os	Affected	v-

🔗 References 3

https://nvd.nist.gov/vuln/detail/CVE-2025-33191

Third Party Advisory

https://nvidia.custhelp.com/app/answers/detail/a_id/...

Vendor Advisory

https://www.cve.org/CVERecord?id=CVE-2025-33191

Third Party Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	Summary	Published
CVE-2026-24218	⚠️ high	8.1	NVIDIA DGX OS contains a vulnerability in the factory provisioning process, where the cloning of a base image causes id...	2026-05-20
CVE-2025-33187	⛔ critical	9.3	NVIDIA DGX Spark GB10 contains a vulnerability in SROOT, where an attacker could use privileged access to gain access to...	2025-11-25
CVE-2025-33188	⚠️ high	8.0	NVIDIA DGX Spark GB10 contains a vulnerability in hardware resources where an attacker could tamper with hardware contro...	2025-11-25
CVE-2025-33189	⚠️ high	7.8	NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause an out-of-bound write. A...	2025-11-25
CVE-2025-33190	🔶 medium	6.7	NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware where an attacker could cause an out-of-bound write. A ...	2025-11-25
CVE-2025-33192	🔶 medium	5.7	NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause an arbitrary memory read...	2025-11-25

These CVEs affect the same products