Read the docs
TI-2022-20490 Aliases CVE-2022-42268GHSA-qcvx-f4h4-vx9h

Injection in NVIDIA Omniverse Audio2Face

Priority LOW 37CWE-74Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

Omniverse Kit contains a vulnerability in the reference applications Create, Audio2Face, Isaac Sim, View, Code, and Machinima. These applications allow executable Python code to be embedded in Universal Scene Description (USD) files to customize all aspects of a scene. If a user opens a USD file that contains embedded Python code in one of these applications, the embedded Python code automatically runs with the privileges of the user who opened the file. As a result, an unprivileged remote attacker could craft a USD file containing malicious Python code and persuade a local user to open the file, which may lead to information disclosure, data tampering, and denial of service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00587 48th percentileScored 2026-11-07
Fix Fixed Omniverse Audio2Face (NVIDIA): 2022.2Omniverse Create (NVIDIA): 2022.3+4 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NVIDIAOmniverse Audio2Facebefore 2022.22022.2Patch availableCNA
NVIDIAOmniverse Createbefore 2022.32022.3Patch availableCNA
NVIDIANVIDIA Isaac Simbefore 2022.2.02022.2.0Patch availableCNA
NVIDIAOmniverse Machinimabefore 2022.32022.3Patch availableCNA
NVIDIAOmniverse Codebefore 2022.3.02022.3.0Patch availableCNA
NVIDIAOmniverse Viewbefore 2022.2.12022.2.1Patch availableCNA
  • Omniverse Audio2Face VendorNVIDIA Affected before 2022.2 Fixed in 2022.2 Patch available CNA
  • Omniverse Create VendorNVIDIA Affected before 2022.3 Fixed in 2022.3 Patch available CNA
  • NVIDIA Isaac Sim VendorNVIDIA Affected before 2022.2.0 Fixed in 2022.2.0 Patch available CNA
  • Omniverse Machinima VendorNVIDIA Affected before 2022.3 Fixed in 2022.3 Patch available CNA
  • Omniverse Code VendorNVIDIA Affected before 2022.3.0 Fixed in 2022.3.0 Patch available CNA
  • Omniverse View VendorNVIDIA Affected before 2022.2.1 Fixed in 2022.2.1 Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:nvidia:nvidia_isaac_sim:*:*:*:*:*:*:*:*before 2022.2.0VulnerableNVIDIA
cpe:2.3:a:nvidia:omniverse_audio2face:*:*:*:*:*:*:*:*before 2022.2VulnerableNVIDIA
cpe:2.3:a:nvidia:omniverse_code:*:*:*:*:*:*:*:*before 2022.3.0VulnerableNVIDIA
cpe:2.3:a:nvidia:omniverse_create:*:*:*:*:*:*:*:*before 2022.3VulnerableNVIDIA
cpe:2.3:a:nvidia:omniverse_machinima:*:*:*:*:*:*:*:*before 2022.3VulnerableNVIDIA
cpe:2.3:a:nvidia:omniverse_view:*:*:*:*:*:*:*:*before 2022.2.1VulnerableNVIDIA
  • cpe:2.3:a:nvidia:nvidia_isaac_sim:*:*:*:*:*:*:*:* Versions before 2022.2.0 Vulnerable ·NVIDIA
  • cpe:2.3:a:nvidia:omniverse_audio2face:*:*:*:*:*:*:*:* Versions before 2022.2 Vulnerable ·NVIDIA
  • cpe:2.3:a:nvidia:omniverse_code:*:*:*:*:*:*:*:* Versions before 2022.3.0 Vulnerable ·NVIDIA
  • cpe:2.3:a:nvidia:omniverse_create:*:*:*:*:*:*:*:* Versions before 2022.3 Vulnerable ·NVIDIA
  • cpe:2.3:a:nvidia:omniverse_machinima:*:*:*:*:*:*:*:* Versions before 2022.3 Vulnerable ·NVIDIA
  • cpe:2.3:a:nvidia:omniverse_view:*:*:*:*:*:*:*:* Versions before 2022.2.1 Vulnerable ·NVIDIA

Remediation

  • Fix · CNA Omniverse Audio2Face (NVIDIA) Fixed in 2022.2
  • Fix · CNA Omniverse Create (NVIDIA) Fixed in 2022.3
  • Fix · CNA NVIDIA Isaac Sim (NVIDIA) Fixed in 2022.2.0
  • Fix · CNA Omniverse Machinima (NVIDIA) Fixed in 2022.3
  • Fix · CNA Omniverse Code (NVIDIA) Fixed in 2022.3.0
  • Fix · CNA Omniverse View (NVIDIA) Fixed in 2022.2.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-42268
  2. 2026-10-03 Alias added: GHSA-qcvx-f4h4-vx9h

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences