CVE-2025-23304 is a high severity (CVSS 7.8) code injection flaw in the model loading component of the NVIDIA NeMo library. Loading a .nemo file with maliciously crafted metadata can lead to remote code execution and data tampering. NVIDIA lists versions prior to 2.3.2 as affected.
What's affected
NVIDIA's August 2025 security bulletin for the NeMo Framework lists Windows, Linux and macOS, with all versions prior to 2.3.2 affected and 2.3.2 as the updated version. It was released on 12 August 2025. NVIDIA adds that earlier software branch releases are also affected, and that users on an earlier branch should upgrade to the latest.
The bulletin covers CVE-2025-23303, a deserialization of untrusted data issue, and CVE-2025-23304, a code injection issue in the model loading component. Both score 7.8, and the vector is local with low privileges and no user interaction. NVIDIA credits Peng Zhou of Shanghai University for the first and Ali Islam of Palo Alto Networks for the second.
How to check if you're exposed
Check the NeMo version in each environment:
pip show nemo_toolkit
Anything before 2.3.2 is affected. NVIDIA's bulletins use both YY.MM style labels and 2.x numbers, so match the version you run to the right line of the bulletin. The vector is local with low privileges, so the risk is highest on shared machines, notebook servers and CI runners where several people can place files for NeMo to load.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Upgrade NeMo to 2.3.2 or later.
- Rebuild images and environments that pin an older release.
- Load only .nemo files and checkpoints from trusted, reviewed sources.
- On shared compute, limit who can write to directories that NeMo jobs read models from.
- Keep a record of which model files your pipelines load and where they came from.
Why it matters
CWE-94 is code injection and CWE-22 is path traversal. NVIDIA's bulletin describes a flaw in the model loading component where crafted metadata in a .nemo file can cause code injection. The CWE list also names path traversal, which suggests that handling of paths within the package is part of the issue, though the bulletin does not spell it out.
A .nemo file is a package of model weights, configuration and metadata. People download these from model hubs and share them in teams. Loading one should be treated like running a program from that source. The KEV flag is false and no exploitation is claimed.
Quick check
Where does the flaw sit?
In the model loading component, via crafted metadata in a .nemo file, according to NVIDIA.
What is the first thing to do?
Upgrade to NeMo 2.3.2 or later, and review where your .nemo files come from.
Sources
Last reviewed: 19 October 2026.
