CVE-2025-33207

MediumCVSS 6.8/10Last modified Oct 14, 2026

Description

NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause improper access control for the register interface by sending a malicious command to the firmware. A successful exploit of this vulnerability might lead to denial of service.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-1262

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
NVIDIABlueField GAAll versions prior to 47.1020
NVIDIABlueField LTS23All versions prior to 39.5124
NVIDIABlueField LTS24All versions prior to 43.4100
NVIDIAConnectX GAAll versions prior to 47.1020
NVIDIAConnectX LTS23All versions prior to 39.5124
NVIDIAConnectX LTS24All versions prior to 43.4100
NVIDIAConnectX-5All versions prior to 16.35.8008

References

Timeline

Published
Sep 29, 2026
Last modified
Oct 14, 2026
NVD status
Awaiting Analysis

Related CVEs from 2025

CVE-2025-332088.8NVIDIA TAO contains a vulnerability where an attacker may cause a resource to be loaded via an uncontrolled search path. A successful exploiCVE-2025-33219.4A predefined administrative account is not documented and cannot be deactivated. This account cannot be misused from the network, only by loCVE-2025-332109.0NVIDIA Isaac Lab contains a deserialization vulnerability. A successful exploit of this vulnerability might lead to code execution.CVE-2025-332117.5NVIDIA Triton Server for Linux contains a vulnerability where an attacker may cause an improper validation of specified quantity in input. ACVE-2025-332127.8NVIDIA NeMo Framework contains a vulnerability in model loading that could allow an attacker to exploit improper control mechanisms if a useCVE-2025-332138.8NVIDIA Merlin Transformers4Rec for Linux contains a vulnerability in the Trainer component, where a user could cause a deserialization issueCVE-2025-332148.8NVIDIA NVTabular for Linux contains a vulnerability in the Workflow component, where a user could cause a deserialization issue. A successfuCVE-2025-332156.8NVIDIA SNAP-4 Container contains a vulnerability in the VIRTIO-BLK component where a malicious guest VM may cause use of out-of-range pointeCVE-2025-332166.8NVIDIA SNAP-4 Container contains a vulnerability in the configuration interface where an attacker on a VM may cause an incorrect calculationCVE-2025-332177.8NVIDIA Display Driver for Windows contains a vulnerability where an attacker could trigger a use after free. A successful exploit of this vuCVE-2025-332187.8NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where an attacker could cause an intCVE-2025-332197.8NVIDIA Display Driver for Linux contains a vulnerability in the NVIDIA kernel module where an attacker could cause an integer overflow or wr
CVE-2025-33207: Medium severity, CVSS 6.8 | Vulnix