CVE-2025-33207

Published: Sep 29, 2026Modified: Oct 14, 2026

6.8

Vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Exploitability: 2.3 / Impact: 4.0

Source: psirt@nvidia.com (Secondary)

Description

NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause improper access control for the register interface by sending a malicious command to the firmware. A successful exploit of this vulnerability might lead to denial of service.

Related CWEs

CWE-1262

Improper Access Control for Register Interface

The product uses memory-mapped I/O registers that act as an interface to hardware functionality from software, but there is improper access control to those registers.

References (3)

https://github.com/NVIDIA/product-security/tree/main/2026/5847

Source: psirt@nvidia.com

https://nvd.nist.gov/vuln/detail/CVE-2025-33207

Source: psirt@nvidia.com

https://www.cve.org/CVERecord?id=CVE-2025-33207

Source: psirt@nvidia.com

Timeline

No history available yet.