NVIDIA DGX Spark (GB10) - SROOT / OSROOT root-of-trust firmware: An invalid memory read in OSROOT firmware crashes

CVSS 5.7CVE-2025-33191NVIDIA / GPU stackcurated

Impact

An invalid memory read in OSROOT firmware crashes the platform. These sit in the GB10 root-of-trust chain, so a successful exploit undermines the platform's own attestation and secure-boot story rather than just the OS above it.

Who can reach it

Local access to the DGX Spark. Several of the set need no privileges at all; the rest need host root. This is a desk-side developer box, so physical and local access assumptions are much weaker than for a racked DGX.

What to do

Apply the DGX Spark firmware update from bulletin 5720. Cost: flash plus reboot, low drain cost given the form factor, but not live-patchable and root-of-trust firmware cannot be rolled back once applied.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-33191 https://github.com/NVIDIA/product-security/tree/main/2025/5720

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.