Cyber Posture

CVE-2025-33223

Critical

Published: 23 December 2025

Published
23 December 2025
Modified
15 January 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0017 38.1th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

NVIDIA Isaac Launchable contains a vulnerability where an attacker could cause an execution with unnecessary privileges. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure and data tampering.

Mitigating Controls (NIST 800-53 r5)AI

AC-6 Least Privilege good match
prevent

AC-6 enforces least privilege, directly countering CWE-250 Execution with Unnecessary Privileges central to CVE-2025-33223 by ensuring processes run only with required access rights.

SI-2 Flaw Remediation good match
prevent

SI-2 mandates identification, reporting, and correction of system flaws like CVE-2025-33223, preventing exploitation via timely patching as noted in NVIDIA advisories.

AC-3 Access Enforcement good match
prevent

AC-3 enforces approved access control policies, mitigating unauthorized code execution and privilege escalation enabled by the vulnerability in NVIDIA Isaac Launchable.

Security SummaryAI

CVE-2025-33223 is a vulnerability in NVIDIA Isaac Launchable that enables an attacker to cause execution with unnecessary privileges, mapped to CWE-250: Execution with Unnecessary Privileges. Published on 2025-12-23, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical due to its high impact on confidentiality, integrity, and availability.

A remote attacker with no required privileges or user interaction can exploit this vulnerability over the network with low complexity. Successful exploitation might lead to arbitrary code execution, escalation of privileges, denial of service, information disclosure, and data tampering.

Advisories providing further details, including potential mitigations and patches, are available from the National Vulnerability Database at https://nvd.nist.gov/vuln/detail/CVE-2025-33223, NVIDIA's security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5749, and CVE.org at https://www.cve.org/CVERecord?id=CVE-2025-33223.

Details

CWE(s)
CWE-250

Affected Products

nvidia
isaac launchable
1.0

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
Why these techniques?

Vulnerability allows remote unauthenticated arbitrary code execution with unnecessary privileges, directly facilitating exploitation of public-facing applications (T1190), remote services (T1210), and privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References