CVE-2025-33192 - NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause an arbitrary memory read

Back Back to CVE browser

MEDIUM

NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause an arbitrary memory read

Published Nov 25, 2025

5.7

MEDIUM

CVSS 3.1

EPSS 0.14%

Description

NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause an arbitrary memory read. A successful exploit of this vulnerability might lead to denial of service.

Affected products

Vendor NVIDIA Product DGX Spark Default
unaffected
- Version
  All versions prior to OTA0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

NVIDIA

DGX Spark

unaffected

Version	Status	Constraints
All versions prior to OTA0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-690

References (3)

https://nvd.nist.gov/vuln/detail/CVE-2025-33192
Third Party Advisory
https://nvidia.custhelp.com/app/answers/detail/a_id/5720
Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2025-33192
Third Party Advisory

Link	Providers	Tags
https://nvd.nist.gov/vuln/detail/CVE-2025-33192		Third Party Advisory
https://nvidia.custhelp.com/app/answers/detail/a_id/5720		Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2025-33192		Third Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner nvidia

Published Nov 25, 2025

Updated Nov 25, 2025

Reserved Apr 15, 2025

Link CVE-2025-33192

CISA Vulnrichment

Updated Nov 25, 2025

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2025-33192

Red Hat

Severity n/a

Public date n/a

Links CVE-2025-33192