CVE-2025-33178

HIGH

NVIDIA NeMo Framework - Code Injection

Title source: llm

Description

NVIDIA NeMo Framework for all platforms contains a vulnerability in the bert services component where malicious data created by an attacker may cause a code injection. A successful exploit of this vulnerability may lead to Code execution, Escalation of privileges, Information disclosure, and Data tampering.

Scores

CVSS v3 7.8
EPSS 0.0003
EPSS Percentile 7.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-94
Status published

Affected Products (1)

nvidia/nemo < 2.5.0

Timeline

Published Nov 11, 2025
Tracked Since Feb 18, 2026