CVE-2025-33223
Published: 23 December 2025
Summary
CVE-2025-33223 is a critical-severity Execution with Unnecessary Privileges (CWE-250) vulnerability in Nvidia Isaac Launchable. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 38.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
AC-6 enforces least privilege, directly countering CWE-250 Execution with Unnecessary Privileges central to CVE-2025-33223 by ensuring processes run only with required access rights.
SI-2 mandates identification, reporting, and correction of system flaws like CVE-2025-33223, preventing exploitation via timely patching as noted in NVIDIA advisories.
AC-3 enforces approved access control policies, mitigating unauthorized code execution and privilege escalation enabled by the vulnerability in NVIDIA Isaac Launchable.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability allows remote unauthenticated arbitrary code execution with unnecessary privileges, directly facilitating exploitation of public-facing applications (T1190), remote services (T1210), and privilege escalation (T1068).
NVD Description
NVIDIA Isaac Launchable contains a vulnerability where an attacker could cause an execution with unnecessary privileges. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure and data tampering.
Deeper analysisAI
CVE-2025-33223 is a vulnerability in NVIDIA Isaac Launchable that enables an attacker to cause execution with unnecessary privileges, mapped to CWE-250: Execution with Unnecessary Privileges. Published on 2025-12-23, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical due to its high impact on confidentiality, integrity, and availability.
A remote attacker with no required privileges or user interaction can exploit this vulnerability over the network with low complexity. Successful exploitation might lead to arbitrary code execution, escalation of privileges, denial of service, information disclosure, and data tampering.
Advisories providing further details, including potential mitigations and patches, are available from the National Vulnerability Database at https://nvd.nist.gov/vuln/detail/CVE-2025-33223, NVIDIA's security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5749, and CVE.org at https://www.cve.org/CVERecord?id=CVE-2025-33223.
Details
- CWE(s)