CVE-2025-33240

NVIDIA Megatron Bridge contains a vulnerability in a data shuffling tutorial, where malicious input could cause a code injection. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://nvd.nist.gov/vuln/detail/CVE-2025-33240	Third Party Advisory US Government Resource
https://nvidia.custhelp.com/app/answers/detail/a_id/5781	Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2025-33240	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nvidia:nemo_megatron_bridge:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-02-18 14:16

Updated : 2026-07-02 14:53

NVD link : CVE-2025-33240

Mitre link : CVE-2025-33240

CVE.ORG link : CVE-2025-33240

JSON object : View

Products Affected

nvidia

nemo_megatron_bridge

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2025-33240", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-33240", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-02-18T14:42:26.161410Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@nvidia.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "psirt@nvidia.com", "affectedData": [{"vendor": "NVIDIA", "product": "Megatron-Bridge", "versions": [{"status": "affected", "version": "All versions prior to 0.2.2"}], "platforms": ["All platforms"], "defaultStatus": "unaffected"}]}], "published": "2026-02-18T14:16:02.743", "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-33240", "tags": ["Third Party Advisory", "US Government Resource"], "source": "psirt@nvidia.com"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5781", "tags": ["Vendor Advisory"], "source": "psirt@nvidia.com"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-33240", "tags": ["Third Party Advisory"], "source": "psirt@nvidia.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@nvidia.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "NVIDIA Megatron Bridge contains a vulnerability in a data shuffling tutorial, where malicious input could cause a code injection. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering."}, {"lang": "es", "value": "NVIDIA Megatron Bridge contiene una vulnerabilidad en un tutorial de mezcla de datos, donde una entrada maliciosa podr\u00eda causar una inyecci\u00f3n de c\u00f3digo. Un exploit exitoso de esta vulnerabilidad podr\u00eda conducir a la ejecuci\u00f3n de c\u00f3digo, escalada de privilegios, revelaci\u00f3n de informaci\u00f3n y manipulaci\u00f3n de datos."}], "lastModified": "2026-07-02T14:53:29.920", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nvidia:nemo_megatron_bridge:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1E93A4CA-1322-4605-A59C-C7E74ED8B746", "versionEndExcluding": "0.2.2"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@nvidia.com"}