CVE-2025-23249 is a high severity (CVSS 7.6) deserialization of untrusted data flaw in the NVIDIA NeMo Framework on Windows, Linux and macOS. It can lead to code execution and data tampering. NVIDIA lists all versions prior to 25.02 as affected and 25.02 as the update.
What's affected
NVIDIA's April 2025 security bulletin for the NeMo Framework lists Windows, Linux and macOS, with all versions prior to 25.02 affected and 25.02 as the updated version. It was released on 22 April 2025. NVIDIA adds that earlier software branch releases are also affected, and that users on an earlier branch should upgrade to the latest release.
The bulletin covers three CVEs: CVE-2025-23249 (deserialization of untrusted data), CVE-2025-23250 (path traversal leading to arbitrary file write) and CVE-2025-23251 (improper control of code generation). Each scores 7.6 and each has user interaction required in its vector. NVIDIA credits Peng Zhou of Shanghai University for the reports.
How to check if you're exposed
NeMo is usually installed as a Python package or inside an NVIDIA container.
pip show nemo_toolkit
pip list | grep -i nemo
In containers, check the image tag, since NVIDIA NeMo containers use a release label. Anything older than 25.02 is affected. Also search shared model storage and pipelines for files that came from outside, such as model checkpoints, because the user interaction in the vector is likely to be loading or opening such content.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Upgrade NeMo Framework to 25.02 or later.
- Rebuild container images that pin an older NeMo release.
- Only load checkpoints, configs and archives from sources you trust.
- Run training and evaluation jobs with the minimum file system and network access they need.
- Add your Python environments to a dependency scan so NeMo advisories reach you.
Why it matters
CWE-502 is deserialization of untrusted data. Machine learning tools commonly save objects with formats that can run code when loaded, so opening a model file or checkpoint from an unknown source can be the same as running that source's code.
NVIDIA's bulletin gives a one line description and does not say which function is involved, so this guide stops there. The wider lesson holds across ML projects: treat model artifacts like executables. Check where they come from, and prefer formats that store only tensors and data. The KEV flag for this CVE is false.
Quick check
What version fixes CVE-2025-23249?
NeMo Framework 25.02. Versions prior to 25.02 are affected.
What does the user need to do for an attack to work?
The vector says user interaction is required, which in this class of bug usually means loading or opening content the attacker prepared.
Sources
Last reviewed: 19 October 2026.
