CVE-2025-33253
Received Received - Intake

Remote Code Execution in NVIDIA NeMo via Malicious File Load

Publication date: 2026-02-18

Last updated on: 2026-02-20

Assigner: NVIDIA Corporation

Description
NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-18
Last Modified
2026-02-20
Generated
2026-07-26
AI Q&A
2026-02-18
EPSS Evaluated
2026-07-25
NVD
CVE-2025-33253

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nvidia nemo to 2.6.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2025-33253 is a vulnerability in the NVIDIA NeMo Framework that allows an attacker to execute remote code by convincing a user to load a maliciously crafted file.

This vulnerability is related to the deserialization of untrusted data (CWE-502), meaning that unsafe data processing can lead to exploitation.

Detection Guidance

I don't know

Impact Analysis

Exploiting this vulnerability can lead to several serious impacts including remote code execution, denial of service, information disclosure, and data tampering.

The vulnerability has a high severity score (CVSS 3.1 base score of 7.8) indicating significant potential damage.

Compliance Impact

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-33253. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart