CVE-2025-33197 Null dereference in DGX Spark

What is CVE-2025-33197?

CVE-2025-33197 is a medium-severity vulnerability in NVIDIA DGX Spark, published on 25 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a NULL pointer dereference. A successful exploit of this vulnerability might lead to denial of service.

Weakness: CWE-476

Which versions are affected by CVE-2025-33197?

It affects 1 product.

Products include Nvidia Dgx Os.

How do I fix CVE-2025-33197?

No fix has been published for CVE-2025-33197 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-33197 being exploited?

There is no known exploitation of CVE-2025-33197 in the wild and no public exploit code.

Other vulnerabilities in NVIDIA DGX Spark

• CVE-2025-33187 Privilege escalation in DGX Spark Critical 9.3
• CVE-2026-24218 Hardcoded credentials in DGX Spark High 8.1
• CVE-2025-33188 Privilege escalation in DGX Spark High 8.0
• CVE-2025-33189 Memory corruption in DGX Spark High 7.8
• CVE-2025-33190 Memory corruption in DGX Spark Medium 6.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r9v6-9429-66g9.