EUVD-2026-65604
GHSA-9vg9-8rq6-7g37
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Local vector confirmed by firmware context; PR:H reflects privileged attacker requirement; S:C captures firmware-to-OS trust boundary crossing with all-High downstream impacts.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause a NULL pointer dereference. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering.
Articles & Coverage 1
AnalysisAI
NULL pointer dereference in NVIDIA DGX Spark system firmware enables a local privileged attacker to achieve code execution with scope change into other system components. All versions of the DGX Spark firmware are affected per the wildcard CPE, with potential impacts spanning code execution, privilege escalation, denial of service, information disclosure, and data tampering. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to the DGX Spark system with high-privilege credentials (CVSS PR:H, AV:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 8.2 (High) with vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H reflects a genuine but access-gated threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix details are referenced via the NVIDIA Product Security repository at https://github.com/NVIDIA/product-security/tree/main/2026/5867, but no specific patched firmware version number is confirmed in the available data - this is classified as 'upstream fix available; released patched version not independently confirmed.' Organizations should monitor the NVIDIA Product Security page and apply any released firmware update as the primary remediation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Complete an inventory of all NVIDIA DGX Spark systems in production and development, documenting firmware versions and operational purpose. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Out-of-bounds write in NVIDIA DGX Spark system firmware enables a privileged local attacker to corrupt memory and achiev
Out-of-bounds write in NVIDIA DGX Spark system firmware permits a locally authenticated, highly privileged attacker to c
Host impersonation and machine-in-the-middle attacks against NVIDIA DGX OS systems are possible because the factory prov
UEFI protection mechanism failure in NVIDIA DGX Spark allows a privileged local user to bypass the UEFI administrator pa
Out-of-bounds read in the NVIDIA DGX Spark standalone Memory Management (MM) firmware enables a local high-privileged at
Same weakness CWE-476 – NULL Pointer Dereference
View allShare
External POC / Exploit Code
Leaving vuln.today