GPU VulnDB

Database/NVIDIA / GPU stack

NVIDIA DGX Spark (GB10) - SROOT / OSROOT root-of-trust firmware: Incorrect control-flow behaviour in SROOT firmware

CVE-2025-33199NVIDIA / GPU stackcurated

Impact

Incorrect control-flow behaviour in SROOT firmware permits data tampering. These sit in the GB10 root-of-trust chain, so a successful exploit undermines the platform's own attestation and secure-boot story rather than just the OS above it.

Who can reach it

Local access to the DGX Spark. Several of the set need no privileges at all; the rest need host root. This is a desk-side developer box, so physical and local access assumptions are much weaker than for a racked DGX.

What to do

Apply the DGX Spark firmware update from bulletin 5720. Cost: flash plus reboot, low drain cost given the form factor, but not live-patchable and root-of-trust firmware cannot be rolled back once applied.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-33199https://github.com/NVIDIA/product-security/tree/main/2025/5720

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.