Home » Database

AVID-2026-R1663

Description

Vulnerability CVE-2025-23249

Details

NVIDIA NeMo Framework contains a vulnerability where a user could cause a deserialization of untrusted data by remote code execution. A successful exploit of this vulnerability might lead to code execution and data tampering.

Reason for inclusion in AVID: The CVE describes a deserialization vulnerability in NVIDIA NeMo Framework enabling remote code execution, a known security risk. NeMo is an AI framework used in ML pipelines, modeling, and deployment, so this is a software supply-chain relevant issue affecting components used to build/run general-purpose AI systems. The vulnerability is clearly security-related with RCE/tampering, and the report provides sufficient evidence (CVE, description, CVSS, references).

References

Affected or Relevant Artifacts

  • Developer: NVIDIA
  • Deployer: NVIDIA
  • Artifact Details:
TypeName
SystemNeMo Framework

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.1
Vector StringCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L
Base Score7.6
Base Severity🔴 High
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality Impact🟢 Low
Integrity Impact🔴 High
Availability Impact🟢 Low

CWE

IDDescription
CWE-502CWE-502 Deserialization of Untrusted Data

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2025-04-22
  • Version: 0.3.3
  • AVID Entry