NVIDIA DGX Spark: out-of-bounds read in standalone MM firmware discloses information across a scope boundary

CVE-2026-24225Firmware, BMC & network fabriccurated

Impact

NVIDIA reports an out-of-bounds read in the standalone MM firmware on DGX Spark, with information disclosure as the outcome. The CVSS vector carries a scope change, meaning what leaks is data belonging to a component outside the one the attacker already controls - firmware-resident memory the OS is not supposed to see. There is no integrity or availability impact scored, so this is a read primitive, not a takeover. The record given here does not describe which structures are readable or what secrets could be recovered, so treat it as a disclosure of firmware memory of unknown sensitivity.

Who can reach it

Local, with high privileges already held on the DGX Spark - an OS administrator or root reaching the firmware interface. No remote path is described.

What to do

Apply the DGX Spark firmware update referenced in NVIDIA's advisory (product-security bulletin 5867, shared with CVE-2026-47624); no fixed firmware version appears in this record. Flashing requires the system out of service for the update and reboot. Given that exploitation already requires privileged local access, this can reasonably ride along with the next scheduled firmware maintenance rather than driving its own window.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-24225 https://github.com/NVIDIA/product-security/tree/main/2026/5867 https://www.cve.org/CVERecord?id=CVE-2026-24225

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.