CVE-2025-33178
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
NVIDIA NeMo Framework contains a vulnerability in the bert services component where malicious data created by an attacker may cause code injection. A successful exploit may lead to code execution, privilege escalation, information disclosure, and data tampering.
Risk Assessment
An attacker could use malicious input data to take control of the environment, escalate privileges, and tamper with data, potentially severely impacting the confidentiality and integrity of AI systems.
Recommendation
Update NVIDIA NeMo Framework to a patched version and validate input data processed by the bert services.
Other vulnerabilities in NVIDIA NeMo Framework
See all- CVE-2026-24155High
The NVIDIA NeMo Framework for all platforms contains a code injection vulnerability. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
- CVE-2025-33204High
NVIDIA NeMo Framework contains a vulnerability in the NLP and LLM components where malicious data crafted by an attacker could cause code injection. A successful exploit may lead to code execution, privilege escalation, information disclosure, and data tampering.
- CVE-2025-23361High
NVIDIA NeMo Framework for all platforms contains a vulnerability in a script, where malicious input created by an attacker may cause improper control of code generation. A successful exploit may lead to code execution, escalation of privileges, information disclosure, and data tampering.
Original NVD description (English source)
NVIDIA NeMo Framework for all platforms contains a vulnerability in the bert services component where malicious data created by an attacker may cause a code injection. A successful exploit of this vulnerability may lead to Code execution, Escalation of privileges, Information disclosure, and Data tampering.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS