CVE-2025-33236
Published: 18 February 2026
Summary
CVE-2025-33236 is a high-severity Code Injection (CWE-94) vulnerability in Nvidia Nemo. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 6.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents code injection by validating malicious data inputs at entry points in the NeMo Framework.
Requires timely remediation of the specific code injection flaw through patching as advised in the NVIDIA security bulletin.
Protects against unauthorized code execution from injected malicious data via memory safeguards like non-executable regions.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CWE-94 code injection directly enables local arbitrary code execution (T1059) and privilege escalation (T1068) with low privileges and no user interaction.
NVD Description
NVIDIA NeMo Framework contains a vulnerability where malicious data created by an attacker could cause code injection. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
Deeper analysisAI
CVE-2025-33236 is a code injection vulnerability (CWE-94) in the NVIDIA NeMo Framework, where malicious data crafted by an attacker can lead to arbitrary code execution. Published on 2026-02-18, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts with local access and low privileges required.
A local attacker with low-level privileges can exploit this vulnerability with low complexity and no user interaction. Successful exploitation might result in arbitrary code execution, escalation of privileges, information disclosure, and data tampering within the affected NeMo Framework environment.
Mitigation details are available in the NVIDIA security advisory at https://nvidia.custhelp.com/app/answers/detail/a_id/5762, along with further analysis on the NVD page at https://nvd.nist.gov/vuln/detail/CVE-2025-33236 and the CVE record at https://www.cve.org/CVERecord?id=CVE-2025-33236. Security practitioners should consult these sources for patch information and workarounds specific to NeMo Framework deployments.
Details
- CWE(s)