CVE-2025-33178

{
  "id": "CVE-2025-33178",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-11T17:15:50.370",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "NVIDIA NeMo Framework for all platforms contains a vulnerability in the bert services component where malicious data created by an attacker may cause a code injection. A successful exploit of this vulnerability may lead to Code execution, Escalation of privileges, Information disclosure, and Data tampering."
    },
    {
      "lang": "es",
      "value": "El framework NVIDIA NeMo para todas las plataformas contiene una vulnerabilidad en el componente de servicios bert donde datos maliciosos creados por un atacante pueden causar una inyección de código. Un exploit exitoso de esta vulnerabilidad puede conducir a la ejecución de código, escalada de privilegios, revelación de información y manipulación de datos."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "NVIDIA",
          "product": "NeMo Framework",
          "defaultStatus": "unaffected",
          "platforms": [
            "All platforms"
          ],
          "versions": [
            {
              "version": "All versions prior to 2.5.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-12T04:58:03.466017Z",
          "id": "CVE-2025-33178",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nvidia:nemo:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.5.0",
              "matchCriteriaId": "E20B853E-AC64-49E9-9DB0-31981B034BFA"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-33178",
      "source": "[email protected]",
      "tags": [
        "Technical Description"
      ]
    },
    {
      "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5718",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-33178",
      "source": "[email protected]",
      "tags": [
        "Technical Description"
      ]
    }
  ]
}