Attackers Exploit NVIDIA Isaac Lab Vulnerability to Run Malicious Code

NVIDIA has disclosed a critical security vulnerability in Isaac Lab, a core component of the NVIDIA Isaac Sim framework, that could allow attackers to execute arbitrary code remotely on vulnerable systems.

The company released security patches in December 2025 to address the deserialization flaw tracked as CVE-2025-32210.

This vulnerability stems from improper deserialization handling in NVIDIA Isaac Lab, enabling threat actors to achieve remote code execution on affected systems.

Critical Risk Assessment

With a CVSS score of 9.0, this flaw is classified as Critical, posing significant risks to organisations using the simulation framework.

The attack vector requires network access with low attack complexity, meaning attackers need only low-level privileges and minimal user interaction to exploit the vulnerability.

The vulnerability’s scope has expanded, indicating that exploitation can affect resources beyond the vulnerable component.

This expansion potentially compromises confidentiality, integrity, and availability at a high level across affected environments.

All versions of Isaac Lab before v2.3.0 across all platforms are vulnerable to CVE-2025-32210. NVIDIA strongly recommends that users immediately update to Isaac Sim v2.3.0, which includes security fixes addressing this deserialization weakness.

Organisations running earlier versions should prioritise patching immediately, as remote code execution vulnerabilities provide attackers with extensive control over compromised systems.

The exploit could enable data theft, system manipulation, or deployment of additional malicious payloads.

Daniel Teixeira from NVIDIA’s AI Red Team discovered and responsibly disclosed the vulnerability. NVIDIA’s Product Security Incident Response Team (PSIRT) released the initial security bulletin on December 2, 2025, providing detailed vulnerability information and remediation guidance.

Users should download the latest Isaac Lab version from the official GitHub repository immediately. Organisations should verify that all Isaac Lab installations are updated to v2.3.0 or later.

NVIDIA recommends subscribing to security bulletin notifications via its Product Security page to stay informed about upcoming vulnerabilities and patches.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.