EUVD-2026-65605
GHSA-hq52-jw5v-9qg5
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Firmware interaction requires high-privilege local access; scope changes as OOB read can expose memory across OS or hypervisor security boundaries with no integrity or availability impact.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
1DescriptionCVE.org
NVIDIA DGX Spark contains a vulnerability in the standalone MM firmware where an attacker could be able to cause an out-of-bounds read. A successful exploit of this vulnerability might lead to information disclosure.
AnalysisAI
Out-of-bounds read in the NVIDIA DGX Spark standalone Memory Management (MM) firmware enables a local high-privileged attacker to read beyond allocated buffer boundaries, leaking potentially sensitive memory contents across security boundaries (S:C/C:H per the CVSS vector). The scope change in the CVSS vector suggests that data disclosed may originate from security domains beyond the firmware itself, such as the host OS or adjacent processes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires both local physical or logical access to the NVIDIA DGX Spark system and high-privilege credentials (PR:H per the CVSS vector - administrator-level or equivalent). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 6.0 reflects a moderate-severity vulnerability constrained by significant attack prerequisites: local access (AV:L) and high privileges (PR:H) are both required, making remote or unauthenticated exploitation impossible. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult NVIDIA's product security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5867 for the official patched firmware version and update procedure; no specific fixed version number is independently confirmable from the currently available data, so the advisory is the authoritative source. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
NULL pointer dereference in NVIDIA DGX Spark system firmware enables a local privileged attacker to achieve code executi
Out-of-bounds write in NVIDIA DGX Spark system firmware enables a privileged local attacker to corrupt memory and achiev
Out-of-bounds write in NVIDIA DGX Spark system firmware permits a locally authenticated, highly privileged attacker to c
Host impersonation and machine-in-the-middle attacks against NVIDIA DGX OS systems are possible because the factory prov
UEFI protection mechanism failure in NVIDIA DGX Spark allows a privileged local user to bypass the UEFI administrator pa
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today