BaseFortify

Publication date: 2025-11-25

Last updated on: 2025-12-02

Assigner: NVIDIA Corporation

Description

NVIDIA NeMo framework contains a vulnerability in a predefined variable, where an attacker could cause inclusion of functionality from an untrusted control sphere by use of a predefined variable. A successful exploit of this vulnerability may lead to code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-25

Last Modified

2025-12-02

Generated

2026-07-06

AI Q&A

2025-11-25

EPSS Evaluated

2026-07-05

NVD

CVE-2025-33205

Affected Vendors & Products

Vendor	Product	Version / Range
nvidia	nemo	to 2.5.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-829	The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability in the NVIDIA NeMo framework involves a predefined variable that an attacker can exploit to include functionality from an untrusted control sphere. This means an attacker could manipulate the system to execute unauthorized code.

Impact Analysis

A successful exploit of this vulnerability may lead to code execution, which can compromise the confidentiality, integrity, and availability of the affected system.

Hi! I’m here to help you understand CVE-2025-33205. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70