Log in Start free

Vulnerability · Published Jan 20, 2026 · Assigned by nvidia

CVE-2025-33228

High 7.3

In plain English

A high-severity OS command injection in CUDA Toolkit from NVIDIA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)1.4%top 28.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

NVIDIA Nsight Systems contains a vulnerability in the gfx_hotspot recipe, where an attacker could cause an OS command injection by supplying a malicious string to the process_nsys_rep_cli.py script if the script is invoked manually. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12nvidia-cuda-toolkitno fix listedDEBIAN-CVE-2025-33228
Debian:13nvidia-cuda-toolkitno fix listedDEBIAN-CVE-2025-33228
Ubuntu:22.04:LTSnvidia-cuda-toolkitno fix listedUBUNTU-CVE-2025-33228
Ubuntu:24.04:LTSnvidia-cuda-toolkitno fix listedUBUNTU-CVE-2025-33228
Ubuntu:25.10nvidia-cuda-toolkitno fix listedUBUNTU-CVE-2025-33228
Ubuntu:26.04:LTSnvidia-cuda-toolkitno fix listedUBUNTU-CVE-2025-33228
Ubuntu:26.10nvidia-cuda-toolkitno fix listedUBUNTU-CVE-2025-33228

Affected products (as reported)

VendorProductVersions
NVIDIA CUDA Toolkit All versions prior to CUDA Toolkit 13.1

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References