CVE-2025-33246
Published: 18 February 2026
Summary
CVE-2025-33246 is a high-severity Command Injection (CWE-77) vulnerability in Nvidia Nemo. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 11.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of inputs at entry points, directly preventing command injection via crafted configuration parameters in the ASR Evaluator utility.
Mandates timely identification, reporting, and correction of flaws like this command injection vulnerability in the NeMo Framework.
Enforces least privilege to limit the impact of code execution, privilege escalation, data tampering, or disclosure from successful command injection by low-privileged local attackers.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection (CWE-77) directly enables arbitrary command execution via crafted local input (T1059) and is explicitly described as leading to privilege escalation (T1068).
NVD Description
NVIDIA NeMo Framework for all platforms contains a vulnerability in the ASR Evaluator utility, where a user could cause a command injection by supplying crafted input to a configuration parameter. A successful exploit of this vulnerability might lead to code…
more
execution, escalation of privileges, data tampering, or information disclosure.
Deeper analysisAI
CVE-2025-33246 is a command injection vulnerability (CWE-77) in the ASR Evaluator utility of the NVIDIA NeMo Framework, affecting all platforms. The issue arises when a user supplies crafted input to a configuration parameter, potentially enabling command injection. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-02-18T14:16:03.393.
A local attacker with low privileges can exploit this vulnerability with low attack complexity and no user interaction. Successful exploitation might lead to code execution, escalation of privileges, data tampering, or information disclosure.
Mitigation details are available in official advisories, including the NVIDIA security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5762, the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-33246, and the CVE record at https://www.cve.org/CVERecord?id=CVE-2025-33246.
Details
- CWE(s)