Use-After-Free Vulnerability in NVIDIA vGPU Manager Enables Code Execution

Publication date: 2026-01-28

Last updated on: 2026-01-28

Assigner: NVIDIA Corporation

Description

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause heap memory access after the memory is freed. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, or information disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-28

Last Modified

2026-01-28

Generated

2026-07-06

AI Q&A

2026-01-29

EPSS Evaluated

2026-07-05

NVD

CVE-2025-33220

EUVD

EUVD-2025-206467

Affected Vendors & Products

Vendor	Product	Version / Range
nvidia	vgpu_software	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the NVIDIA vGPU software's Virtual GPU Manager, where a malicious guest can cause heap memory to be accessed after it has been freed. This type of flaw can be exploited to execute arbitrary code, escalate privileges, tamper with data, cause denial of service, or disclose sensitive information.

Impact Analysis

If exploited, this vulnerability can lead to serious impacts including unauthorized code execution, privilege escalation, data tampering, denial of service, and information disclosure, potentially compromising system security and stability.

Hi! I’m here to help you understand CVE-2025-33220. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70