CVE-2025-33199 Other in DGX Spark

What is CVE-2025-33199?

CVE-2025-33199 is a low-severity vulnerability in NVIDIA DGX Spark, published on 25 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause incorrect control flow behavior. A successful exploit of this vulnerability might lead to data tampering.

Weakness: CWE-670

Which versions are affected by CVE-2025-33199?

It affects 1 product.

Products include Nvidia Dgx Os.

How do I fix CVE-2025-33199?

No fix has been published for CVE-2025-33199 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-33199 being exploited?

There is no known exploitation of CVE-2025-33199 in the wild and no public exploit code.

Other vulnerabilities in NVIDIA DGX Spark

• CVE-2025-33187 Privilege escalation in DGX Spark Critical 9.3
• CVE-2026-24218 Hardcoded credentials in DGX Spark High 8.1
• CVE-2025-33188 Privilege escalation in DGX Spark High 8.0
• CVE-2025-33189 Memory corruption in DGX Spark High 7.8
• CVE-2025-33190 Memory corruption in DGX Spark Medium 6.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vw24-hhmf-xp64.