NVIDIA Issues Security Update for NeMo Framework: Multiple High-Severity Vulnerabilities Patched

NVIDIA has released a security update for its NeMo Framework addressing multiple high-severity vulnerabilities that could allow attackers to execute arbitrary code, escalate privileges, steal sensitive information, and tamper with data. The four issues are tracked as CVE-2025-23312, CVE-2025-23313, CVE-2025-23314, and CVE-2025-23315, each rated 7.8 (High) on the CVSS scale.

According to NVIDIA, “NVIDIA NeMo Framework for all platforms contains a vulnerability in the retrieval services component, where malicious data created by an attacker could cause a code injection. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.” The flaws affect all versions prior to 2.4.0 across Windows, Linux, and macOS, with version 2.4.0 released to include fixes for all four CVEs.

If left unpatched, these vulnerabilities could be exploited in AI model training, deployment, and NLP pipelines, enabling arbitrary code execution, privilege escalation, access to sensitive credentials or training data, and potential tampering of AI datasets or outputs.