CVE-2025-33210
Published: 16 December 2025
Summary
CVE-2025-33210 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Nvidia Isaac Lab. Its CVSS base score is 9.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 37.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the deserialization vulnerability by requiring timely identification, reporting, and correction of the specific flaw in NVIDIA Isaac Lab.
Prevents exploitation of the deserialization vulnerability by validating and filtering untrusted network inputs before deserialization to block malicious payloads.
Mitigates arbitrary code execution resulting from successful deserialization by implementing memory protections such as DEP and ASLR.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Deserialization vulnerability (CWE-502) in NVIDIA Isaac Lab leads to arbitrary code execution with network access, low privileges, and user interaction, directly facilitating exploitation of client software vulnerabilities.
NVD Description
NVIDIA Isaac Lab contains a deserialization vulnerability. A successful exploit of this vulnerability might lead to code execution.
Deeper analysisAI
CVE-2025-33210 is a deserialization vulnerability (CWE-502) affecting NVIDIA Isaac Lab. A successful exploit of this vulnerability might lead to code execution. The issue has a CVSS v3.1 base score of 9.0, with the vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, indicating network accessibility, low attack complexity, low privileges required, user interaction needed, changed scope, and high impacts across confidentiality, integrity, and availability. It was published on 2025-12-16.
An attacker with low privileges can exploit this vulnerability over the network with low complexity, though it requires user interaction. Upon successful exploitation, the attacker can achieve arbitrary code execution, resulting in high-impact compromise of the affected system.
Advisories providing further details and potential mitigations are available from the NVIDIA security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5733, the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-33210, and the CVE record at https://www.cve.org/CVERecord?id=CVE-2025-33210.
Details
- CWE(s)