CVE-2025-33181

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could inject a command. A successful exploit of this vulnerability might lead to escalation of privileges.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

VendorProductVersions
NVIDIACumulus Linux GAAll versions prior to 5.14 (5.13.x, 5.12.x, and older GA versions)
NVIDIACumulus Linux LTSAll versions prior to 5.11.4
NVIDIACumulus Linux LTSAll versions prior to 5.9.4
NVIDIANVOSAll versions prior to 1.3 - 25.02.244
NVIDIANVOSAll versions prior to 25.02.4282
NVIDIANVOSAll versions prior to 25.02.5030

References

Timeline

Published
Feb 24, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-331827.6NVIDIA Jetson Linux contains a vulnerability in UEFI, where improper authentication may allow a privileged user to cause corruption of the LCVE-2025-331837.8NVIDIA Isaac-GR00T for all platforms contains a vulnerability in a Python component, where an attacker could cause a code injection issue. ACVE-2025-331847.8NVIDIA Isaac-GR00T for all platforms contains a vulnerability in a Python component, where an attacker could cause a code injection issue. ACVE-2025-331855.3NVIDIA AIStore contains a vulnerability in AuthN where an unauthenticated user may cause information disclosure.  A successful exploit of thCVE-2025-331868.8NVIDIA AIStore contains a vulnerability in AuthN. A successful exploit of this vulnerability might lead to escalation of privileges, informaCVE-2025-331877.8NVIDIA DGX Spark GB10 contains a vulnerability in SROOT, where an attacker could use privileged access to gain access to SoC protected areasCVE-2025-331887.8NVIDIA DGX Spark GB10 contains a vulnerability in hardware resources where an attacker could tamper with hardware controls. A successful expCVE-2025-331897.8NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause an out-of-bound write. A successful exploit CVE-2025-33199.8IBM Spectrum Protect Server 8.1 through 8.1.26 could allow attacker to bypass authentication due to improper session authentication which caCVE-2025-331907.8NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware where an attacker could cause an out-of-bound write. A successful exploit oCVE-2025-331915.5NVIDIA DGX Spark GB10 contains a vulnerability in OSROOT firmware, where an attacker could cause an invalid memory read. A successful exploiCVE-2025-331925.5NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause an arbitrary memory read. A successful explo
CVE-2025-33181: High severity, CVSS 8.8 | Vulnix