What is the CVSS score of CVE-2025-33214?

CVE-2025-33214 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of NVIDIA NVTabular are affected by CVE-2025-33214?

NVTabular, the tabular-data preprocessing component used in NVIDIA's Merlin recommender-system stack, contains a deserialization flaw that can permit code execution, data tampering, and service…

How to fix or mitigate CVE-2025-33214?

Within 24 hours, inventory all Linux hosts and container images running NVTabular (particularly Merlin-based recommender pipelines), confirm the deployed version, and issue an immediate directive to data science and ML engineering teams that serialized workflow objects, preprocessing pipelines, and dataset artifacts must only be loaded from internal, verified sources; temporarily block or quarantine externally received pickle/deserialized artifacts pending review. Within 7 days, deploy a allowlist-based policy for workflow artifact provenance, run all NVTabular workflow loading inside sandboxed containers with least-privilege service accounts, no unnecessary network egress, and restricted filesystem mounts, and enable monitoring for anomalous child processes or outbound connections spawned by NVTabular jobs; also implement checksum or signature verification for shared pipeline artifacts stored in internal repositories. Within 30 days, engage NVIDIA support and monitor the vendor advisory and NVIDIA Merlin release notes for a fixed NVTabular version, and once released, validate and roll it out across all affected hosts; in parallel, review and harden any application code paths that deserialize untrusted workflow objects, and consider replacing unsafe deserialization with a safe serialization format where feasible. Escalate to the vendor if no patch timeline is provided, given the absence of a vendor-released fix at time of analysis.

NVIDIA NVTabular CVE-2025-33214

HIGH

Deserialization of Untrusted Data (CWE-502)

2025-12-09 psirt@nvidia.com

RCE Denial Of Service Information Disclosure Deserialization Nvidia

8.8

CVSS 3.1 · Vendor: nvidia

Severity by source

Vendor (nvidia) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Untrusted deserialization yields full code execution (C/I/A:H); no auth needed (PR:N) but the victim must load a malicious workflow object, so UI:R; AV:N reflects network-delivered artifacts.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (nvidia).

CVSS VectorVendor: nvidia

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 10:34 vuln.today

CVE Published

Dec 09, 2025 - 18:15 cve.org

HIGH 8.8

DescriptionCVE.org

NVIDIA NVTabular for Linux contains a vulnerability in the Workflow component, where a user could cause a deserialization issue. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.

AnalysisAI

Deserialization of untrusted data in the NVTabular Workflow component on Linux can let attackers achieve code execution, denial of service, information disclosure, and data tampering on affected ML/data-engineering hosts. Per the assessed vector (AV:N/AC:L/PR:N/UI:R), no authentication is needed, but successful exploitation requires the victim to load or deserialize an attacker-supplied workflow object - for example a shared preprocessing pipeline or dataset artifact - so social delivery of a trusted-looking workflow file is a prerequisite. EPSS is low (0.66%, ~50th percentile) and no public exploit has been identified at time of analysis; the vulnerability is serious but conditional and largely confined to NVTabular deployments rather than general-purpose servers.

Technical ContextAI

The root cause is CWE-502 (Deserialization of Untrusted Data), and the affected component is the NVTabular Workflow, the abstraction NVTabular uses to chain preprocessing and feature-engineering operators in GPU-accelerated recommender-system and tabular-data pipelines. NVTabular is a Python library that serializes and reloads workflow definitions and associated artifacts (for example via Python's pickle machinery and related serialization mechanisms), so reconstructing an attacker-controlled serialized object executes attacker-chosen logic during object instantiation, producing arbitrary code execution, crashes/denial of service, memory or file disclosure, and silent modification of processed data. Because the affected artifact is a workflow file rather than a network service, the attack path is delivery-and-load rather than direct remote exploitation: an attacker must convince a user or pipeline to deserialize a malicious workflow. The scenario is specific to Linux hosts running NVTabular, typically inside data-science or MLOps environments where such serialized pipelines are shared between users, jobs, or repositories, which broadens the practical risk in collaborative settings - matching the assessed conditions of low complexity and no authentication but mandatory user interaction.

Affected ProductsAI

The affected product is NVIDIA NVTabular for Linux, specifically the Workflow component. The provided intelligence does not enumerate the exact affected NVTabular release ranges, and no CPE strings were supplied with this record; the authoritative version matrix should be taken from NVIDIA's security advisory at https://nvidia.custhelp.com/app/answers/detail/a_id/5739 (referenced alongside the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2025-33214 and the CVE record https://www.cve.org/CVERecord?id=CVE-2025-33214). NVTabular is deployed in GPU-accelerated ML and data-engineering environments rather than as general-purpose server software, which limits the population of exposed hosts.

RemediationAI

No vendor-released patch version is identified in the available data; consult the NVIDIA advisory at https://nvidia.custhelp.com/app/answers/detail/a_id/5739 and the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2025-33214 for the official fixed release and upgrade NVTabular as soon as a patched version is published, since the vulnerability is in the library's own workflow deserialization path. Until then, apply compensating controls: treat all serialized NVTabular workflow files, pipelines, and dataset artifacts as untrusted input and only load them from verified, integrity-checked sources (hashing or signing shared pipelines) - this directly removes the delivery vector at the cost of requiring provenance checks on legitimate workflows. Where feasible, avoid deserializing workflows from pickle-style formats and prefer safer interchange formats (for example configuration-only JSON/YAML definitions) and never unpickle objects from untrusted users; this trades away some pickled-artifact compatibility. Run NVTabular workloads in a sandboxed, least-privilege container with read-only mounts and restricted filesystem and network egress so that a successful deserialization cannot escalate to host compromise or data exfiltration, accepting the operational overhead of containerization; and restrict write/read access to shared workflow repositories to trusted personnel to reduce the chance of a malicious pipeline being planted. These measures mitigate but do not eliminate the risk, and none should be treated as a substitute for the official vendor fix.