CVE-2025-33253: NVIDIA NeMo Framework Deserializes Untrusted Data

February 18, 2026 (updated February 20, 2026)

NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.

References

github.com/NVIDIA-NeMo/NeMo
github.com/advisories/GHSA-hvjw-vp7g-39h5
nvd.nist.gov/vuln/detail/CVE-2025-33253
nvidia.custhelp.com/app/answers/detail/a_id/5762
www.cve.org/CVERecord?id=CVE-2025-33253

Code Behaviors & Features

Detect and mitigate CVE-2025-33253 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →