CVE-2025-33247

NVIDIA Megatron LM contains a vulnerability in quantization configuration loading, which could allow remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://nvd.nist.gov/vuln/detail/CVE-2025-33247	Third Party Advisory US Government Resource
https://nvidia.custhelp.com/app/answers/detail/a_id/5769	Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2025-33247	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nvidia:megatron-lm:*:*:*:*:*:*:*:*

History

17 Jun 2026, 09:13

Type	Values Removed	Values Added
Summary		(es) NVIDIA Megatron LM contiene una vulnerabilidad en la carga de la configuración de cuantificación, lo que podría permitir la ejecución remota de código. Un exploit exitoso de esta vulnerabilidad podría conducir a la ejecución de código, escalada de privilegios, revelación de información y manipulación de datos.

25 Mar 2026, 21:58

Type	Values Removed	Values Added
First Time		Nvidia megatron-lm Nvidia
CPE		cpe:2.3:a:nvidia:megatron-lm::::::::
References	~~() https://nvd.nist.gov/vuln/detail/CVE-2025-33247 -~~	() https://nvd.nist.gov/vuln/detail/CVE-2025-33247 - Third Party Advisory, US Government Resource
References	~~() https://nvidia.custhelp.com/app/answers/detail/a_id/5769 -~~	() https://nvidia.custhelp.com/app/answers/detail/a_id/5769 - Vendor Advisory
References	~~() https://www.cve.org/CVERecord?id=CVE-2025-33247 -~~	() https://www.cve.org/CVERecord?id=CVE-2025-33247 - Third Party Advisory

24 Mar 2026, 21:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-24 21:16

Updated : 2026-06-17 09:13

NVD link : CVE-2025-33247

Mitre link : CVE-2025-33247

CVE.ORG link : CVE-2025-33247

JSON object : View

Products Affected

nvidia

megatron-lm

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2025-33247", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-33247", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-03-25T14:02:08.256709Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@nvidia.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "psirt@nvidia.com", "affectedData": [{"vendor": "NVIDIA", "product": "Megatron LM", "versions": [{"status": "affected", "version": "All versions prior to 0.15.3"}], "platforms": ["All platforms"], "defaultStatus": "unaffected"}]}], "published": "2026-03-24T21:16:24.610", "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-33247", "tags": ["Third Party Advisory", "US Government Resource"], "source": "psirt@nvidia.com"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5769", "tags": ["Vendor Advisory"], "source": "psirt@nvidia.com"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-33247", "tags": ["Third Party Advisory"], "source": "psirt@nvidia.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@nvidia.com", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "NVIDIA Megatron LM contains a vulnerability in quantization configuration loading, which could allow remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering."}, {"lang": "es", "value": "NVIDIA Megatron LM contiene una vulnerabilidad en la carga de la configuraci\u00f3n de cuantificaci\u00f3n, lo que podr\u00eda permitir la ejecuci\u00f3n remota de c\u00f3digo. Un exploit exitoso de esta vulnerabilidad podr\u00eda conducir a la ejecuci\u00f3n de c\u00f3digo, escalada de privilegios, revelaci\u00f3n de informaci\u00f3n y manipulaci\u00f3n de datos."}], "lastModified": "2026-06-17T09:13:18.293", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nvidia:megatron-lm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "05221D08-E8D5-4CBE-8B4E-8CE4C8176AB4", "versionEndExcluding": "0.15.3"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@nvidia.com"}