NVIDIA Critical AI Patch: Isaac Lab and NeMo Framework Flaws Risk Full Code Execution

NVIDIA has rolled out a security update addressing multiple high‑severity vulnerabilities across its AI and simulation ecosystem, including the Isaac Sim robotics platform, NeMo Framework and the Resiliency Extension. The most severe deserialization flaw resides in Isaac Lab, with a CVSS score of 9.0, and is addressed in Isaac Sim version 2.3.0 which patches all prior Isaac Lab releases.

The NeMo Framework patch, needed for all platforms running versions before 2.5.3, fixes two high‑severity vulnerabilities: CVE‑2025‑33212 (CVSS 7.3) and CVE‑2025‑33226 (CVSS 7.8), the latter enabling code execution, privilege escalation, information disclosure and data tampering if malicious data is loaded.

The third bulletin targets the NVIDIA Resiliency Extension for Linux, where CVE‑2025‑33225 (CVSS 8.4) could yield predictable log file names leading to further risks, and CVE‑2025‑33235 (CVSS 7.8) could allow a race condition with unauthorized data access or privilege escalation. Administrators should upgrade to NeMo Framework 2.5.3 and ensure Isaac Sim users update to the patched versions, as these flaws present a credible path for attackers to execute code or pivot within networks, according to the bulletin. With more enterprises adopting AI tools, the updates are urged to be applied immediately.