NVIDIA DGX Spark: out-of-bounds read in standalone MM firmware discloses information across a scope boundary

Impact

NVIDIA reports an out-of-bounds read in the standalone MM firmware on DGX Spark, with information disclosure as the outcome. The CVSS vector carries a scope change, meaning what leaks is data belonging to a component outside the one the attacker already controls - firmware-resident memory the OS is not supposed to see. There is no integrity or availability impact scored, so this is a read primitive, not a takeover. The record given here does not describe which structures are readable or what secrets could be recovered, so treat it as a disclosure of firmware memory of unknown sensitivity.

Who can reach it

Local, with high privileges already held on the DGX Spark - an OS administrator or root reaching the firmware interface. No remote path is described.

What to do

Apply the DGX Spark firmware update referenced in NVIDIA's advisory (product-security bulletin 5867, shared with CVE-2026-47624); no fixed firmware version appears in this record. Flashing requires the system out of service for the update and reboot. Given that exploitation already requires privileged local access, this can reasonably ride along with the next scheduled firmware maintenance rather than driving its own window.

References

Related entries

• NVIDIA DGX Spark: UEFI administrator password protection can be bypassed by a privileged local userCVE-2026-47624 · NVIDIA DGX Spark (UEFI administrator password protection)Medium
• Arista EOS: gNPSI client credentials can be written in clear text to accounting logsCVE-2026-73457 · Arista EOS gNPSI (client credentials in accounting logs)Medium
• Arista EOS: gNSI authz policy rotation can fail silently, leaving revoked gRPC access in placeCVE-2026-73463 · Arista EOS gNSI Authz service (policy rotation race with multiple gNSI transports)Medium
• Arista EOS: private keys, user passwords and TACACS+ secrets logged in cleartext when debug tracing is onCVE-2026-73465 · Arista EOS logging (secrets written in cleartext under non-standard debug trace levels)Medium
• Infineon TPM firmware (RSA key generation): RSA keys generated inside affected Infineon TPMs are factorableCVE-2017-15361 · Infineon TPM firmware (RSA key generation)Medium
• STMicroelectronics ST33 TPM (ECDSA timing): Discrete TPM leaks ECDSA nonce data through timing, allowing private keyCVE-2019-16863 · STMicroelectronics ST33 TPM (ECDSA timing)Medium