CVE-2025-33189CWE-787

NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause an out-of-bound write

High · published November 25, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
7.1
In the wild
Unconfirmed
What it is

🚨 A troubling flaw lurks in NVIDIA DGX Spark GB10's SROOT firmware, allowing an out-of-bounds write that could unleash chaos! ⚡ Think of it like a factory assembly line where a worker can slip a note into the wrong spot, disrupting the entire process. Just one misplaced action could lead to faulty products rolling off the line, or worse, giving dangerous powers to unauthorized individuals! If exploited, an attacker could run arbitrary code, alter data, or even crash the system entirely! This is like handing over the keys to your vault, allowing them to change the locks, steal your valuables, or lock you out completely. The potential for privilege escalation is particularly alarming — imagine a lowly intern suddenly being granted CEO-level access!

Put simply

Think of it like a factory assembly line where a worker can slip a note into the wrong spot, disrupting the entire process. Just one misplaced action could lead to faulty products rolling off the line, or worse, giving dangerous powers to unauthorized individuals! The vulnerability in SROOT firmware allows for an out-of-bounds write, enabling attackers to manipulate memory in unexpected ways, potentially executing arbitrary code or compromising system integrity.

What to do

If exploited, an attacker could run arbitrary code, alter data, or even crash the system entirely! This is like handing over the keys to your vault, allowing them to change the locks, steal your valuables, or lock you out completely. The potential for privilege escalation is particularly alarming — imagine a lowly intern suddenly being granted CEO-level access! To protect your systems, promptly update the NVIDIA DGX Spark GB10 firmware to the latest version provided by NVIDIA. Conduct a thorough security review to ensure no other vulnerabilities are present in your environment. Regularly audit permissions and access controls to minimize risks. You've got this! Fixing this vulnerability will keep your systems secure and give you that extra superhero edge! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00179 · 7.1th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2025-11-25T17:58Z
EPSS history
Timeline
  • 25 NOV 17:58Z
    NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause an out-of-bound write
    cvelistv5