CVE-2025-33195 MEDIUM

CVE-2025-33195

Vendor Nvidia
Product DGX Spark
Weakness CWE-119
Published November 25, 2025
Last update February 26, 2026

CVSS base score

4.4/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause unexpected memory buffer operations. A successful exploit of this vulnerability might lead to data tampering, denial of service, or escalation of privileges.

Key dates

02Disclosure timeline

November 25, 2025 CVE published
February 26, 2026 Record updated