TI-2023-14769 Aliases CVE-2023-31032 GHSA-5q7c-3gj2-48qw

NVIDIA DGX A100 SBIOS contains a vulnerability where a user may cause a dynamic variable…

LOW 34CWE-627Published 2024-01-12 · Updated 2025-06-03

Key facts

Attack vector: Local
Privileges required: High
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

NVIDIA DGX A100 SBIOS contains a vulnerability where a user may cause a dynamic variable evaluation by local access. A successful exploit of this vulnerability may lead to denial of service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00163 5th percentileScored 2026-11-07

Fix Fixed DGX A100 (nvidia): 1.25

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NVIDIA	DGX A100	before 1.25	1.25	Patch available	CNA

DGX A100 VendorNVIDIA Affected before 1.25 Fixed in 1.25 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:nvidia:dgx_a100_firmware:::::sbios:::*	before 1.25	Vulnerable	NVIDIA
cpe:2.3:h:nvidia:dgx_a100:-:::::::*	not specified by NVD	Running on	NVIDIA

cpe:2.3:o:nvidia:dgx_a100_firmware:*:*:*:*:sbios:*:*:* Versions before 1.25 Vulnerable ·NVIDIA
cpe:2.3:h:nvidia:dgx_a100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA

Remediation

Fix · CNA DGX A100 (nvidia) Fixed in 1.25

Timeline

2026-10-02 Threatist record created from CVE-2023-31032
2026-10-03 Alias added: GHSA-5q7c-3gj2-48qw

References

Advisory 1

https://nvidia.custhelp.com/app/answers/detail/a_id/5510

TI-2023-14766 Stack-based buffer overflow in NVIDIA DGX A100 CVSS 3.1CRITICAL 9.8
TI-2023-14767 Stack-based buffer overflow in NVIDIA DGX A100 CVSS 3.1CRITICAL 9.8
TI-2023-14761 Stack-based buffer overflow in NVIDIA DGX A100 CVSS 3.1CRITICAL 9.8
TI-2022-20512 OS command injection in NVIDIA DGX servers CVSS 3.1HIGH 8.8
TI-2022-20511 OS command injection in NVIDIA DGX servers CVSS 3.1HIGH 8.8
TI-2022-20501 OS command injection in NVIDIA DGX servers CVSS 3.1HIGH 8.8

See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences