EUVD-2026-65606
GHSA-7gf4-6396-r332
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
High privileges and local access required to reach UEFI; scope change reflects firmware compromise extending beyond OS boundary with no confidentiality or availability impact.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
1DescriptionCVE.org
NVIDIA DGX Spark contains a vulnerability in UEFI where a Attacker may cause a/an CWE-693 by privileged local user. A successful exploit of this vulnerability may allow an attacker to bypass administrator password protection in UEFi.
AnalysisAI
UEFI protection mechanism failure in NVIDIA DGX Spark allows a privileged local user to bypass the UEFI administrator password, undermining firmware-level access controls. The CVSS vector (AV:L/PR:H/S:C/I:H) confirms local high-privilege access is required, but a successful exploit extends beyond the OS security boundary - a scope change that elevates the real-world impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a privileged local user account on the NVIDIA DGX Spark system, consistent with the CVSS vector PR:H/AV:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 6.0 accurately captures the constrained attack surface: exploitation requires physical or remote high-privilege local access (AV:L/PR:H), and low attack complexity (AC:L) indicates no race condition or special timing is needed once access is established. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No specific patched version number is confirmed by the available input data; the NVIDIA Product Security repository at https://github.com/NVIDIA/product-security/tree/main/2026/5867 should be consulted for the official advisory and fix release details. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
NULL pointer dereference in NVIDIA DGX Spark system firmware enables a local privileged attacker to achieve code executi
Out-of-bounds write in NVIDIA DGX Spark system firmware enables a privileged local attacker to corrupt memory and achiev
Out-of-bounds write in NVIDIA DGX Spark system firmware permits a locally authenticated, highly privileged attacker to c
Host impersonation and machine-in-the-middle attacks against NVIDIA DGX OS systems are possible because the factory prov
Out-of-bounds read in the NVIDIA DGX Spark standalone Memory Management (MM) firmware enables a local high-privileged at
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today