NVIDIA DGX Spark EUVD-2026-65602

Exploitation requires local access to the DGX Spark appliance and high operating privileges (mapped as PR:H in the CVSS vector), consistent with firmware-level or BMC administrative access - not ordinary OS user credentials. The attack is confined to local access (AV:L), meaning remote unauthenticated exploitation is not possible without a separate initial-access step. The vulnerability is in the system firmware itself; exploitation is not conditional on a specific optional feature being enabled, but does require the attacker to have a pathway to interact with firmware interfaces. Factors limiting exploitation: (1) high privilege prerequisite rules out unprivileged local users and remote unauthenticated attackers; (2) physical or network-based access to the out-of-band management interface is typically required; (3) DGX Spark appliances are generally deployed in controlled datacenter environments, not exposed to untrusted users.

The CVSS 3.1 score of 8.2 is driven primarily by the scope-change (S:C) and full CIA triad impact (C:H/I:H/A:H), which appropriately reflects how a firmware-level compromise can cascade into the host OS. However, the mandatory prerequisites of local access (AV:L) and high privileges (PR:H) substantially constrain the realistic attacker pool to those who already have administrative or firmware-management access to the appliance - insider threat, supply-chain tampering, or post-exploitation pivots are the most plausible paths. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified from this source. There is no CISA KEV listing and no reported public exploit code, which together suggest this has not yet seen opportunistic exploitation. The absence of EPSS data is a meaningful gap: without it, prioritization must lean on contextual factors rather than empirical exploitation probability. The S:C component is the critical differentiator - any organization running DGX Spark nodes as shared AI infrastructure, where firmware compromise could laterally affect co-tenant workloads or the management plane, should treat this as a higher operational priority than the PR:H prerequisite alone might suggest.

An attacker who has already obtained high-privilege local access to a DGX Spark node - through credential theft, insider access, or a prior privilege escalation from a lower-privileged OS account - crafts a malicious input to a firmware interface that triggers the out-of-bounds write. The corrupted firmware memory allows the attacker to redirect firmware execution flow, breaking out of the firmware's isolation boundary and gaining capabilities at a scope that can affect the host OS or management plane. No public proof-of-concept code has been identified at time of analysis.