CVE-2025-33200

Nov. 25, 2025, 10:16 p.m.

2.3
Low

Description

NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploit of this vulnerability might lead to information disclosure.

Product(s) Impacted

Vendor Product Versions
Nvidia
  • Dgx Spark G10
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-226
Sensitive Information in Resource Not Removed Before Reuse
The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a nvidia dgx_spark_g10 / / / / / / / /

References

https://nvd.nist.gov/vuln/detail/CVE-2025-33200
https://nvidia.custhelp.com/app/answers/detail/a_id/5720
https://www.cve.org/CVERecord?id=CVE-2025-33200

Tags

psirt@nvidia.com
CWE-226
2025-11-25
CVE-2025-33200

CVSS Score

2.3 / 10

CVSS Data - 3.1

  • Attack Vector: LOCAL
  • Attack Complexity: LOW
  • Privileges Required: HIGH
  • Scope: UNCHANGED
  • Confidentiality Impact: LOW
  • Integrity Impact: NONE
  • Availability Impact: NONE

    • CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

    View Vector String

Timeline

Published: Nov. 25, 2025, 6:15 p.m.
Last Modified: Nov. 25, 2025, 10:16 p.m.

Status : Undergoing Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

psirt@nvidia.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.