CVE-2025-23303 is a high severity (CVSS 7.8) deserialization of untrusted data flaw in the NVIDIA NeMo Framework that can lead to code execution and data tampering. NVIDIA lists all versions prior to 2.3.2 on Windows, Linux and macOS as affected and 2.3.2 as the update.
What's affected
NVIDIA's August 2025 security bulletin for the NeMo Framework lists Windows, Linux and macOS, with all versions prior to 2.3.2 affected and 2.3.2 as the updated version. It was released on 12 August 2025. NVIDIA adds that earlier software branch releases are also affected, and that users on an earlier branch should upgrade to the latest.
The bulletin covers CVE-2025-23303, a deserialization of untrusted data issue, and CVE-2025-23304, a code injection issue in the model loading component. Both score 7.8, and the vector is local with low privileges and no user interaction. NVIDIA credits Peng Zhou of Shanghai University for the first and Ali Islam of Palo Alto Networks for the second.
How to check if you're exposed
Check the NeMo version in each environment:
pip show nemo_toolkit
Anything before 2.3.2 is affected. NVIDIA's bulletins use both YY.MM style labels and 2.x numbers, so match the version you run to the right line of the bulletin. The vector is local with low privileges, so the risk is highest on shared machines, notebook servers and CI runners where several people can place files for NeMo to load.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Upgrade NeMo to 2.3.2 or later.
- Rebuild images and environments that pin an older release.
- Load only .nemo files and checkpoints from trusted, reviewed sources.
- On shared compute, limit who can write to directories that NeMo jobs read models from.
- Keep a record of which model files your pipelines load and where they came from.
Why it matters
CWE-502 is deserialization of untrusted data. When software rebuilds objects from stored bytes, a crafted input can make it run code. Model files are a common carrier because they are shared widely and trusted by habit.
NVIDIA's bulletin gives a short description of this issue only, so this guide does not claim more. The practical move is the same as for the April NeMo CVEs: upgrade, and treat model artifacts from outside your team as untrusted until checked. This is the second NeMo deserialization bulletin in 2025, a sign that the class is worth checking for in your ML dependencies generally. The KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What fixes CVE-2025-23303?
NeMo Framework 2.3.2. All versions prior to 2.3.2 are affected.
Does it need a network?
No. The vector is local with low privileges, so the attacker needs a foothold or a way to place a file that gets loaded.
Sources
Last reviewed: 19 October 2026.
