CVE-2025-33220

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause heap memory access after the memory is freed. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, or information disclosure.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
NVIDIAGeForceAll driver versions prior to 590.48.01
NVIDIAGeForceAll driver versions prior to 580.126.09
NVIDIAGeForceAll driver versions prior to 570.211.01
NVIDIAGeForceAll driver versions prior to 535.288.01
NVIDIARTX PRO, RTX, QuadroAll driver versions prior to 590.48.01
NVIDIARTX PRO, RTX, QuadroAll driver versions prior to 580.126.09
NVIDIARTX PRO, RTX, QuadroAll driver versions prior to 570.211.01
NVIDIARTX PRO, RTX, QuadroAll driver versions prior to 535.288.01
NVIDIATeslaAll driver versions prior to 590.48.01
NVIDIATeslaAll driver versions prior to 580.126.09
NVIDIATeslaAll driver versions prior to 570.211.01
NVIDIATeslaAll driver versions prior to 535.288.01
NVIDIAVirtual GPU Manager580.105.06(All versions prior to and including vGPU software 19.3)
NVIDIAVirtual GPU Manager570.195.02(All versions prior to and including vGPU software 18.5)
NVIDIAVirtual GPU Manager535.274.03(All versions prior to and including vGPU software 16.13)

References

Timeline

Published
Jan 28, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-332216.0NVIDIA Display Driver for Windows and Linux contains a vulnerability in the kernel driver, where a user could cause an incorrect permission CVE-2025-332229.8NVIDIA Isaac Launchable contains a vulnerability where an attacker could exploit a hard-coded credential issue. A successful exploit of thisCVE-2025-332239.8NVIDIA Isaac Launchable contains a vulnerability where an attacker could cause an execution with unnecessary privileges. A successful exploiCVE-2025-332249.8NVIDIA Isaac Launchable contains a vulnerability where an attacker could cause an execution with unnecessary privileges. A successful exploiCVE-2025-332258.4NVIDIA Resiliency Extension for Linux contains a vulnerability in log aggregation, where an attacker could cause predictable log-file names.CVE-2025-332267.8NVIDIA NeMo Framework for all platforms contains a vulnerability where malicious data created by an attacker may cause a code injection. A sCVE-2025-332287.3NVIDIA Nsight Systems contains a vulnerability in the gfx_hotspot recipe, where an attacker could cause an OS command injection by supplyingCVE-2025-332297.3NVIDIA Nsight Visual Studio for Windows contains a vulnerability in Nsight Monitor where an attacker can execute arbitrary code with the samCVE-2025-33238.8A vulnerability classified as critical was found in godcheese/code-projects Nimrod 0.8. Affected by this vulnerability is the function searcCVE-2025-332307.3NVIDIA Nsight Systems for Linux contains a vulnerability in the .run installer, where an attacker could cause an OS command injection by supCVE-2025-332316.7NVIDIA Nsight Systems for Windows contains a vulnerability in the application’s DLL loading mechanism where an attacker could cause an unconCVE-2025-332337.8NVIDIA Merlin Transformers4Rec for all platforms contains a vulnerability where an attacker could cause code injection. A successful exploit
CVE-2025-33220: High severity, CVSS 7.8 | Vulnix