SB2026051882 - Two vulnerabilities in NVIDIA NeMo Framework (December 2025)

Description

This security bulletin contains information about 2 vulnerabilities.

1) Deserialization of Untrusted Data (CVE-ID: CVE-2025-33212)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a local user to execute arbitrary code, escalate privileges, cause a denial of service, or tamper with data.

The vulnerability exists due to deserialization of untrusted data in model loading when loading a maliciously crafted file. A local user can supply a maliciously crafted file to execute arbitrary code, escalate privileges, cause a denial of service, or tamper with data.

User interaction is required to load a crafted file.

2) Deserialization of Untrusted Data (CVE-ID: CVE-2025-33226)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code, escalate privileges, disclose sensitive information, or tamper with data.

The vulnerability exists due to deserialization of untrusted data in data handling when processing malicious data created by an attacker. A local user can provide malicious data to execute arbitrary code, escalate privileges, disclose sensitive information, or tamper with data.

Remediation

Install update from vendor's website.

References

• https://nvidia.custhelp.com/app/answers/detail/a_id/5736
• https://www.nvidia.com/security