CVE-2025-33251
Remote Code Execution Vulnerability in NVIDIA NeMo Framework
Publication date: 2026-02-18
Last updated on: 2026-02-20
Assigner: NVIDIA Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nvidia | nemo | to 2.6.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
A successful exploit of this vulnerability might lead to remote code execution, allowing an attacker to run arbitrary code on the affected system.
It can also cause denial of service, making the system or application unavailable.
Additionally, it may result in information disclosure, exposing sensitive data.
Data tampering is another possible impact, where the integrity of data can be compromised.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability requires local access to the NVIDIA NeMo Framework and involves improper control of code generation (code injection). Detection would typically involve checking for the presence and version of the NVIDIA NeMo Framework on your system.
Since the vulnerability is local and related to code injection, network detection methods are limited. Instead, you should verify if the vulnerable software is installed and check for suspicious local activity or unexpected code execution within the NeMo Framework environment.
Specific commands to detect the vulnerability are not provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps are not explicitly detailed in the provided resources.
General best practices include restricting local access to systems running the NVIDIA NeMo Framework, applying any available patches or updates from NVIDIA once released, and monitoring for unusual activity related to the framework.
Can you explain this vulnerability to me?
CVE-2025-33251 is a vulnerability in the NVIDIA NeMo Framework that allows an attacker to execute remote code.
This vulnerability is classified under CWE-94, which corresponds to improper control of code generation, commonly known as code injection.
Exploiting this flaw can result in remote code execution, denial of service, information disclosure, and data tampering.