Cyber Posture

CVE-2025-33252

High

Published: 18 February 2026

Published
18 February 2026
Modified
20 February 2026
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0023 46.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-33252 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Nvidia Nemo. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 46.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly remediates the CWE-502 deserialization vulnerability in NVIDIA NeMo Framework by applying vendor-specific patches to prevent exploitation.

prevent

Enforces validation of untrusted inputs before deserialization, directly countering the root cause of remote code execution in this CVE.

prevent

Implements memory safeguards like ASLR and DEP to protect against unauthorized code execution resulting from deserialization exploits.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

CWE-502 deserialization flaw directly enables arbitrary code execution on the target system.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.

Deeper analysisAI

CVE-2025-33252 is a vulnerability in the NVIDIA NeMo Framework that enables an attacker to cause remote code execution. A successful exploit could result in code execution, denial of service, information disclosure, and data tampering. The vulnerability is associated with CWE-502 (Deserialization of Untrusted Data) and has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). It was published on 2026-02-18.

The attack vector is local (AV:L), with low attack complexity and requiring low privileges (PR:L), no user interaction, and unchanged scope. A local attacker with low-level access to the affected system could exploit this flaw to achieve high impacts on confidentiality, integrity, and availability, potentially leading to the described outcomes including remote code execution.

Mitigation details are available in advisories from the National Vulnerability Database (https://nvd.nist.gov/vuln/detail/CVE-2025-33252), NVIDIA (https://nvidia.custhelp.com/app/answers/detail/a_id/5762), and CVE.org (https://www.cve.org/CVERecord?id=CVE-2025-33252). Security practitioners should consult these resources for patching instructions and workarounds specific to the NVIDIA NeMo Framework.

Details

CWE(s)

Affected Products

nvidia
nemo
≤ 2.6.1

CVEs Like This One

CVE-2025-33241Same product: Nvidia Nemo
CVE-2025-33245Same product: Nvidia Nemo
CVE-2025-33253Same product: Nvidia Nemo
CVE-2026-24157Same product: Nvidia Nemo
CVE-2025-33243Same product: Nvidia Nemo
CVE-2026-24159Same product: Nvidia Nemo
CVE-2025-33250Same product: Nvidia Nemo
CVE-2025-33249Same product: Nvidia Nemo
CVE-2025-33246Same product: Nvidia Nemo
CVE-2025-33236Same product: Nvidia Nemo

References