EUVD-2026-65602
GHSA-p6fm-c6gf-c334
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Firmware OOB write demands high local privilege (PR:H, AV:L); no user interaction; scope change justified because firmware compromise can affect the host OS layer above it.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering.
Articles & Coverage 1
AnalysisAI
Out-of-bounds write in NVIDIA DGX Spark system firmware permits a locally authenticated, highly privileged attacker to corrupt firmware memory in a way that crosses the firmware's isolation boundary into the broader system. Successful exploitation may yield arbitrary code execution, privilege escalation beyond the initial firmware context, denial of service, information disclosure, and data tampering - all stemming from a single CWE-787 write primitive. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to the DGX Spark appliance and high operating privileges (mapped as PR:H in the CVSS vector), consistent with firmware-level or BMC administrative access - not ordinary OS user credentials. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.2 is driven primarily by the scope-change (S:C) and full CIA triad impact (C:H/I:H/A:H), which appropriately reflects how a firmware-level compromise can cascade into the host OS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the NVIDIA Product Security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5867 for authoritative patch guidance; no specific fixed firmware version number was present in the input data, so a patched release version cannot be independently confirmed from this analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all NVIDIA DGX Spark systems, restrict console and management access to essential personnel only, and enable enhanced access logging. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
NULL pointer dereference in NVIDIA DGX Spark system firmware enables a local privileged attacker to achieve code executi
Out-of-bounds write in NVIDIA DGX Spark system firmware enables a privileged local attacker to corrupt memory and achiev
Host impersonation and machine-in-the-middle attacks against NVIDIA DGX OS systems are possible because the factory prov
UEFI protection mechanism failure in NVIDIA DGX Spark allows a privileged local user to bypass the UEFI administrator pa
Out-of-bounds read in the NVIDIA DGX Spark standalone Memory Management (MM) firmware enables a local high-privileged at
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today