Read the docs
TI-2022-10991 Aliases CVE-2022-28200GHSA-mqfm-vc95-gg95

Memory corruption in NVIDIA DGX A100

Priority LOW 35CWE-119Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

NVIDIA DGX A100 contains a vulnerability in SBIOS in the BiosCfgTool, where a local user with elevated privileges can read and write beyond intended bounds in SMRAM, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The scope of impact can extend to other components.

Why it matters now

EPSS 0.00249 16th percentileScored 2026-11-07
Fix Fixed NVIDIA DGX A100 (NVIDIA): 22.5.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
NVIDIANVIDIA DGX A100before 22.5.522.5.5Patch availableCNA
  • NVIDIA DGX A100 VendorNVIDIA Affected before 22.5.5 Fixed in 22.5.5 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:nvidia:dgx_a100_firmware:*:*:*:*:*:*:*:*before 22.5.5VulnerableNVIDIA
cpe:2.3:h:nvidia:dgx_a100:-:*:*:*:*:*:*:*not specified by NVDRunning onNVIDIA
  • cpe:2.3:o:nvidia:dgx_a100_firmware:*:*:*:*:*:*:*:* Versions before 22.5.5 Vulnerable ·NVIDIA
  • cpe:2.3:h:nvidia:dgx_a100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA

Remediation

  • Fix · CNA NVIDIA DGX A100 (NVIDIA) Fixed in 22.5.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-28200
  2. 2026-10-03 Alias added: GHSA-mqfm-vc95-gg95

References

Advisory 1

  • TI-2023-14766 Stack-based buffer overflow in NVIDIA DGX A100 CVSS 3.1CRITICAL 9.8
  • TI-2023-14767 Stack-based buffer overflow in NVIDIA DGX A100 CVSS 3.1CRITICAL 9.8
  • TI-2023-14761 Stack-based buffer overflow in NVIDIA DGX A100 CVSS 3.1CRITICAL 9.8
  • TI-2022-20512 OS command injection in NVIDIA DGX servers CVSS 3.1HIGH 8.8
  • TI-2022-20511 OS command injection in NVIDIA DGX servers CVSS 3.1HIGH 8.8
  • TI-2022-20501 OS command injection in NVIDIA DGX servers CVSS 3.1HIGH 8.8
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences