InfoSecBulletin Cybersecurity for mankind
NVIDIA has issued a dual security alert for developers and data scientists, announcing important updates for its Nsight Graphics and Merlin recommender system. Both vulnerabilities have a high CVSS score of 7.8 and can allow harmful code injection attacks that may compromise entire systems.
The flaws jeopardize the tools needed for creating future visual applications and AI models, threatening development processes.
14,000 Dahua cameras compromised: TP-Link flaws enable RCE
Microsoft Reveals Project Zenith Windows PCs Able to Run 30B+ AI Models Locally
Google issues warning of new Chrome zero-day flaw exploited
CrowdStrike’s ‘FalconFlank’ zero-day allows SYSTEM privileges
727,000 data exposes: French hospital fined €500,000
153 Million Driver’s License Surfaced on Dark Web: FBI Starts Investigation
Google Unveils Gemini 3.8 Flash Cyber to Identify and Auto-Patch Security Flaws
SonicWall SMA1000 SSRF Hits 10, Exploiting CVE-2026-83548
Gartner
70% of SOCs Will Pilot AI Agents: Only 15% Will See Results
CVE-2026-62911
Nearly 22,000 Microsoft Exchange Servers are vulnerable to attack
CVE-2025-33206 is a vulnerability in Nsight Graphics, a tool for debugging graphics applications, affecting its Linux version. This flaw allows attackers to run malicious commands.
According to the security bulletin, “NVIDIA NSIGHT Graphics for Linux contains a vulnerability where an attacker could cause command injection”.
Exploiting this vulnerability could have serious consequences. The bulletin states that a successful attack might allow code execution, privilege escalation, data tampering, and denial of service. This means an attacker could take control of a developer’s workstation or crash their debugging environment.
The vulnerability affects “All versions prior to NSIGHT Graphics 2025.5” on Linux. Developers are urged to “download and install this software update from the Download NVIDIA NSIGHT Graphics page” to version 2025.5.
The second patch fixes a security flaw in NVIDIA Merlin Transformers4Rec, a library for creating recommendation systems with Transformers. Known as CVE-2025-33233, this vulnerability affects all platforms and is as severe as the graphics issue.
“NVIDIA Merlin Transformers4Rec for all platforms contains a vulnerability where an attacker could cause a code injection issue,” the advisory states.
Like the Nsight flaw, this vulnerability allows for a range of malicious outcomes, including “Code Execution, Data Tampering, Information Disclosure, and Escalation of Privileges”. For AI researchers working with sensitive datasets or proprietary models, the risk of information disclosure and data tampering is particularly acute.
All software versions lacking a specific security commit are affected. To fix this, users should update to any code branch with commit 27ddd49.
