NVIDIA Family Security Update Advisory
Overview
We have released a security update to fix vulnerabilities in NVIDIA products. Users of affected products are advised to update to the latest version.
Affected Products
CVE-2025-23294
NVIDIA WebDataset versions: All versions that do not include commit 9e95f50
CVE-2025-23295
NVIDIA Apex versions: below 25.07
CVE-2025-23296
NVIDIA Isaac-GR00T N1 Versions: All versions not including commit 9ca97e1
CVE-2025-23298
NVIDIA Merlin Transformers4Rec Version: All versions not including commit b7eaea5
Cve-2025-23305, cve-2025-23306
Megatron-LM Versions: less than 0.12.2
Cve-2025-23303, cve-2025-23304
NVIDIA NeMo Framework Version: Less than 2.3.2
Resolved Vulnerabilities
Arbitrary code execution vulnerability with elevated privilege in NVIDIA WebDataset (CVE-2025-23294)
Code Injection Vulnerability in the NVIDIA Apex Python Component (CVE-2025-23295)
Code Injection Vulnerability in NVIDIA Isaac-GR00T Python Component (CVE-2025-23296)
Code Injection Vulnerability in NVIDIA Merlin Transformers4Rec Python Dependency (CVE-2025-23298)
Code Injection Vulnerability in NVIDIA Megatron-LM tools component (CVE-2025-23305)
Malicious Input-Based Code Injection Vulnerability in NVIDIA Megatron-LM training arguments.py (CVE-2025-23306)
Untrusted data deserialization vulnerability due to remote code execution in NVIDIA NeMo Framework (CVE-2025-23303)
Malicious .nemo file-based code injection vulnerability in the NVIDIA NeMo Library Model Loading component (CVE-2025-23304)
Vulnerability Patches
Vulnerability Patches have been made available in the latest updates. Please follow the instructions on the Referenced Sites to update to the latest Vulnerability Patches version.
CVE-2025-23294
NVIDIA WebDataset versions: All versions including commit 9e95f50
CVE-2025-23295
NVIDIA Apex Version: 25.07
CVE-2025-23296
NVIDIA Isaac-GR00T N1 Version: All versions including commit 9ca97e1
CVE-2025-23298
NVIDIA Merlin Transformers4Rec Version: All versions including commit b7eaea5
CVE-2025-23305, CVE-2025-23306
Megatron-LM Version: 0.12.2
CVE-2025-23303, CVE-2025-23304
NVIDIA NeMo Framework Version: 2.3.2
References
[1] Security Bulletin: NVIDIA WebDataset – August 2025
https://nvidia.custhelp.com/app/answers/detail/a_id/5658
[2] Security Bulletin: NVIDIA Apex – August 2025
https://nvidia.custhelp.com/app/answers/detail/a_id/5680
[3] Security Bulletin: NVIDIA Isaac-GR00T – August 2025
https://nvidia.custhelp.com/app/answers/detail/a_id/5681
[4] Security Bulletin: NVIDIA Merlin Transformers4Rec – August 2025
https://nvidia.custhelp.com/app/answers/detail/a_id/5683
[5] Security Bulletin: NVIDIA Megatron LM – August 2025
https://nvidia.custhelp.com/app/answers/detail/a_id/5685
[6] Security Bulletin: NVIDIA NeMo Framework – August 2025
https://nvidia.custhelp.com/app/answers/detail/a_id/5686