What is the CVSS score of CVE-2025-33215?

CVE-2025-33215 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Nvidia are affected by CVE-2025-33215?

Organizations using NVIDIA SNAP-4 Container should be aware of notable risk from CVE-2025-33215 rated CVSS 6.8. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2025-33215?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Nvidia CVE-2025-33215

EUVD-2025-208964 MEDIUM

Use of Out-of-range Pointer Offset (CWE-823)

2026-03-24 nvidia

GHSA-c4x2-4777-gmwq

Denial Of Service Memory Corruption Nvidia

6.8

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 24, 2026 - 20:31 euvd

EUVD-2025-208964

Analysis Generated

Mar 24, 2026 - 20:31 vuln.today

CVE Published

Mar 24, 2026 - 20:21 nvd

MEDIUM 6.8

DescriptionNVD

NVIDIA SNAP-4 Container contains a vulnerability in the VIRTIO-BLK component where a malicious guest VM may cause use of out-of-range pointer offset by sending crafted messages. A successful exploit of this vulnerability may lead to a denial of service of the DPA and impact the availability of storage to other VMs.

AnalysisAI

NVIDIA SNAP-4 Container contains a use-of-out-of-range pointer offset vulnerability in the VIRTIO-BLK component that allows a malicious guest VM to trigger memory corruption and denial of service. The vulnerability affects NVIDIA SNAP-4 Container across all versions as indicated by the CPE string. A successful exploit results in denial of service to the DPA (Data Processing Appliance) and impacts storage availability to other VMs, though no code execution or information disclosure is possible. There is no evidence of active exploitation in the wild (KEV status indicates none), and the CVSS score of 6.8 reflects moderate severity with high availability impact but limited exploitability due to requiring adjacent network access and user privileges.

Technical ContextAI

VIRTIO-BLK is a virtual block device interface used in virtualized environments to provide storage access to guest virtual machines. The vulnerability exists in NVIDIA's SNAP-4 Container implementation, which is a containerized environment for DPA appliances. The root cause is classified under CWE-823 (Use of Out-of-range Pointer Offset), indicating that crafted messages from a malicious guest VM can cause pointer arithmetic to reference invalid memory locations. This is a memory safety issue where insufficient bounds checking on pointer offset calculations allows an attacker to access arbitrary memory regions within the VIRTIO-BLK handler, leading to memory corruption. The affected product is NVIDIA SNAP-4 Container (all versions per CPE: cpe:2.3:a:nvidia:snap-4_container:*:*:*:*:*:*:*:*).

RemediationAI

Apply the security update provided by NVIDIA for SNAP-4 Container through the official advisory at https://nvidia.custhelp.com/app/answers/detail/a_id/5744. Until patches can be deployed, implement network segmentation to restrict guest VM communication and limit the blast radius of a potential attack by isolating DPA appliances in secured network zones. Additionally, restrict guest VM access to VIRTIO-BLK operations where possible through hypervisor-level access controls, and monitor DPA systems for unexpected service restarts or availability issues that may indicate exploitation attempts. Prioritize patching in environments where guest VMs are not fully trusted or managed by different administrative domains.