CVE-2025-33220CWE-416

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause heap memory access after the memory is freed

High · published January 28, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
10.0
In the wild
Unconfirmed
What it is

⚡ A malicious guest could exploit heap memory access in NVIDIA's vGPU software, causing chaos in your virtual environment! 🔥 Think of it like a restaurant where a rogue diner can sneak into the kitchen after they've finished their meal — they could tamper with recipes or even poison the food before the next customer arrives! If exploited, this vulnerability could lead to code execution, privilege escalation, data tampering, or even a denial of service. Just imagine an attacker gaining unauthorized control over your virtual machines, causing absolute havoc and compromising sensitive information!

Put simply

Think of it like a restaurant where a rogue diner can sneak into the kitchen after they've finished their meal — they could tamper with recipes or even poison the food before the next customer arrives! This vulnerability resides in NVIDIA's Virtual GPU Manager, where a malicious guest can access freed heap memory, potentially allowing them to execute arbitrary code or escalate privileges.

What to do

If exploited, this vulnerability could lead to code execution, privilege escalation, data tampering, or even a denial of service. Just imagine an attacker gaining unauthorized control over your virtual machines, causing absolute havoc and compromising sensitive information! To safeguard your systems, patch to the latest NVIDIA vGPU software version as soon as possible, and ensure that proper isolation measures are in place for virtual guests. Regularly review access permissions and monitor your virtual environments for suspicious activity. You've got this! Follow these steps, and you'll be one step closer to taming the vGPU beast. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00206 · 10.0th percentile
Weakness
CWE-416 · Use After Free
Published
2026-01-28T17:48Z
EPSS history
Timeline
  • 28 JAN 17:48Z
    NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause heap memory access after the memory is freed
    cvelistv5