CVE-2025-33178

NVIDIA NeMo Framework for all platforms contains a vulnerability in the bert services component where malicious data created by an attacker may cause a code injection. A successful exploit of this vulnerability may lead to Code execution, Escalation of privileges, Information disclosure, and Data tampering.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://nvd.nist.gov/vuln/detail/CVE-2025-33178	Technical Description
https://nvidia.custhelp.com/app/answers/detail/a_id/5718	Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2025-33178	Technical Description

Configurations

Configuration 1 (hide)

cpe:2.3:a:nvidia:nemo:*:*:*:*:*:*:*:*

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) El framework NVIDIA NeMo para todas las plataformas contiene una vulnerabilidad en el componente de servicios bert donde datos maliciosos creados por un atacante pueden causar una inyección de código. Un exploit exitoso de esta vulnerabilidad puede conducir a la ejecución de código, escalada de privilegios, revelación de información y manipulación de datos.

Information

Published : 2025-11-11 17:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-33178

Mitre link : CVE-2025-33178

CVE.ORG link : CVE-2025-33178

JSON object : View

Products Affected

nvidia

nemo

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2025-33178", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-33178", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-12T04:58:03.466017Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@nvidia.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "psirt@nvidia.com", "affectedData": [{"vendor": "NVIDIA", "product": "NeMo Framework", "versions": [{"status": "affected", "version": "All versions prior to 2.5.0"}], "platforms": ["All platforms"], "defaultStatus": "unaffected"}]}], "published": "2025-11-11T17:15:50.370", "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-33178", "tags": ["Technical Description"], "source": "psirt@nvidia.com"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5718", "tags": ["Vendor Advisory"], "source": "psirt@nvidia.com"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-33178", "tags": ["Technical Description"], "source": "psirt@nvidia.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@nvidia.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "NVIDIA NeMo Framework for all platforms contains a vulnerability in the bert services component where malicious data created by an attacker may cause a code injection. A successful exploit of this vulnerability may lead to Code execution, Escalation of privileges, Information disclosure, and Data tampering."}, {"lang": "es", "value": "El framework NVIDIA NeMo para todas las plataformas contiene una vulnerabilidad en el componente de servicios bert donde datos maliciosos creados por un atacante pueden causar una inyecci\u00f3n de c\u00f3digo. Un exploit exitoso de esta vulnerabilidad puede conducir a la ejecuci\u00f3n de c\u00f3digo, escalada de privilegios, revelaci\u00f3n de informaci\u00f3n y manipulaci\u00f3n de datos."}], "lastModified": "2026-10-18T21:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nvidia:nemo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E20B853E-AC64-49E9-9DB0-31981B034BFA", "versionEndExcluding": "2.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@nvidia.com"}