Cyber Posture

CVE-2025-33244

Critical

Published: 24 March 2026

Published
24 March 2026
Modified
25 March 2026
KEV Added
—
Patch
—
CVSS Score 9.0 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0011 29.7th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

NVIDIA APEX for Linux contains a vulnerability where an unauthorized attacker could cause a deserialization of untrusted data. This vulnerability affects environments that use PyTorch versions earlier than 2.6. A successful exploit of this vulnerability might lead to code execution,…

more

denial of service, escalation of privileges, data tampering, and information disclosure.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Timely flaw remediation through patching PyTorch to version 2.6 or later directly eliminates the deserialization vulnerability in NVIDIA APEX.

SI-10 Information Input Validation good match
prevent

Information input validation prevents deserialization of untrusted data by ensuring serialized inputs are verified before processing in PyTorch environments.

SI-16 Memory Protection partial match
prevent

Memory protection mechanisms like ASLR and DEP mitigate arbitrary code execution resulting from successful deserialization exploits.

Security SummaryAI

CVE-2025-33244 is a deserialization of untrusted data vulnerability (CWE-502) in NVIDIA APEX for Linux. This issue affects environments using PyTorch versions earlier than 2.6, where an unauthorized attacker could trigger the deserialization of untrusted data. The vulnerability carries a CVSS v3.1 base score of 9.0 (AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and was published on 2026-03-24.

An adjacent attacker with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Scope changes to a higher scope upon successful exploitation, potentially allowing arbitrary code execution, denial of service, privilege escalation, data tampering, and information disclosure.

Mitigation details are available in official advisories, including NVIDIA's security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5782, the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-33244, and the CVE record at https://www.cve.org/CVERecord?id=CVE-2025-33244.

Details

CWE(s)
CWE-502

AI Security AnalysisAI

AI Category
Deep Learning Frameworks
Risk Domain
N/A
OWASP Top 10 for LLMs 2025
None mapped
MITRE ATLAS Techniques
None mapped
Classification Reason
Matched keywords: pytorch

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
Why these techniques?

Deserialization vulnerability enables remote exploitation over adjacent network (AV:A) with low privileges (PR:L) leading to scope change, arbitrary code execution, and privilege escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References