NVIDIA Isaac Launchable CVE-2025-33224

The CVE description (CWE-250, Execution with Unnecessary Privileges) indicates the required condition is interaction with an NVIDIA Isaac Launchable (version 1.0) component that runs with more privileges than necessary; the concrete trigger - the specific interface, input, or launchable configuration - is not named in the provided description and must be obtained from NVIDIA advisory a_id/5749. Limiting factors: exploitation is bounded to environments that actually deploy Isaac Launchable (a specialized NVIDIA robotics/AI developer product), which sharply narrows the exposed population; while the supplied CVSS vector lists PR:N/UI:N, the privilege-scoping nature of CWE-250 suggests a precondition such as an existing foothold or the ability to feed input to the privileged component, so real-world exploitation likely depends on prior access rather than pure anonymous remote reach.

The input assigns a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which on its face describes a remote, unauthenticated, low-complexity flaw with total confidentiality, integrity, and availability impact - a worst-case profile. However, this rating is in tension with the underlying weakness, CWE-250 (Execution with Unnecessary Privileges), which typically describes a component running with more rights than needed so that a separate foothold is escalated, rather than a directly network-reachable entry point. The terse NVIDIA description ('an attacker could cause an execution with unnecessary privileges') does not specify a remote network vector or the delivery mechanism, so the AV:N/PR:N/UI:N metric choices cannot be independently corroborated from the description and should be verified against NVIDIA advisory a_id/5749. On the real-world signals: this is not in CISA KEV and no public exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis.' EPSS is 0.81% (56th percentile) - low-to-moderate and unremarkable, which is consistent with the absence of known exploitation and argues against treating this as an active, widespread threat despite the high CVSS. No SSVC decision data was provided. Net: the 9.8 overstates likely real-world urgency for most defenders; priority should be driven by whether an organization actually deploys NVIDIA Isaac Launchable, with patching scheduled on normal cadence rather than emergency timelines.

An attacker with the ability to interact with or supply input to an NVIDIA Isaac Launchable component leverages the fact that the component runs with unnecessarily elevated privileges to execute code or actions in that privileged context. Given the CWE-250 nature, this most plausibly chains from an existing low-privilege foothold or a crafted input into the launchable, yielding escalation and full compromise of the host. No public proof-of-concept is referenced in the provided data.