InfoSecBulletin Cybersecurity for mankind
NVIDIA has issued a dual security alert for developers and data scientists, announcing important updates for its Nsight Graphics and Merlin recommender system. Both vulnerabilities have a high CVSS score of 7.8 and can allow harmful code injection attacks that may compromise entire systems.
The flaws jeopardize the tools needed for creating future visual applications and AI models, threatening development processes.
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
CVE-2025-33206 is a vulnerability in Nsight Graphics, a tool for debugging graphics applications, affecting its Linux version. This flaw allows attackers to run malicious commands.
According to the security bulletin, “NVIDIA NSIGHT Graphics for Linux contains a vulnerability where an attacker could cause command injection”.
Exploiting this vulnerability could have serious consequences. The bulletin states that a successful attack might allow code execution, privilege escalation, data tampering, and denial of service. This means an attacker could take control of a developer’s workstation or crash their debugging environment.
The vulnerability affects “All versions prior to NSIGHT Graphics 2025.5” on Linux. Developers are urged to “download and install this software update from the Download NVIDIA NSIGHT Graphics page” to version 2025.5.
The second patch fixes a security flaw in NVIDIA Merlin Transformers4Rec, a library for creating recommendation systems with Transformers. Known as CVE-2025-33233, this vulnerability affects all platforms and is as severe as the graphics issue.
“NVIDIA Merlin Transformers4Rec for all platforms contains a vulnerability where an attacker could cause a code injection issue,” the advisory states.
Like the Nsight flaw, this vulnerability allows for a range of malicious outcomes, including “Code Execution, Data Tampering, Information Disclosure, and Escalation of Privileges”. For AI researchers working with sensitive datasets or proprietary models, the risk of information disclosure and data tampering is particularly acute.
All software versions lacking a specific security commit are affected. To fix this, users should update to any code branch with commit 27ddd49.
