NVIDIA NeMo Framework Deserialization & Code Injection Vulnerabilities (CVE-2025-23303/23304)

### Critical Vulnerability Information #### Vulnerability Details | CVE ID | Description | Vector | Base Score | Severity | CWE | Impact | |--------|-------------|--------|------------|----------|-----|--------| | CVE-2025-23303 | NVIDIA NeMo Framework for all platforms contains a vulnerability where a user could cause deserialization of untrusted data via remote code execution. A successful exploit of this vulnerability may lead to remote code execution and data tampering. | AV:LOCAL/PR:LOW/UI:N/S:C/C:H/I:H/A:H | 7.8 | High | CWE-502 | Code Execution, Data Tampering | | CVE-2025-23304 | NVIDIA NeMo library for all platforms contains a vulnerability in the model loading component, where an attacker could cause code injection by loading stereo files with maliciously crafted metadata. A successful exploit of this vulnerability may lead to remote code execution and data tampering. | AV:LOCAL/PR:LOW/UI:N/S:C/C:H/I:H/A:H | 7.8 | High | CWE-94 | Code Execution, Data Tampering | #### Security Updates | CVE ID | Affected Product | Platform or OS | Affected Versions | Updated Version | |--------|------------------|----------------|------------------|-----------------| | CVE-2025-23303CVE-2025-23304 | NVIDIA NeMo Framework | Windows, Linux, macOS | All versions below 2.3.2 | 2.3.2 | #### Notes - Earlier software branches are also affected. If you are using an earlier branch version, please upgrade to the latest branch release. #### Acknowledgments - Thank you to Peng Zhou from Shanghai University for reporting the CVE-2025-23303 issue. - Thank you to Ali Islam from Palo Alto Networks for reporting the CVE-2025-23304 issue.

Goal Reached Thanks to every supporter — we hit 100%!

NVIDIA NeMo Framework Deserialization & Code Injection Vulnerabilities (CVE-2025-23303/23304)