Cyber Posture

CVE-2025-33228

High

Published: 20 January 2026

Published
20 January 2026
Modified
02 February 2026
KEV Added
Patch
CVSS Score 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0002 6.6th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-33228 is a high-severity OS Command Injection (CWE-78) vulnerability in Nvidia Cuda Toolkit. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Windows Command Shell (T1059.003); ranked at the 6.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Windows Command Shell (T1059.003) and 2 other techniques.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

MITRE ATT&CK Enterprise TechniquesAI

T1059.003 Windows Command Shell Execution
Adversaries may abuse the Windows command shell for execution.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

OS command injection (CWE-78) in a CLI script directly enables arbitrary OS command execution via T1059 subtechniques; requires user execution of the script with malicious input (T1204.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

NVIDIA Nsight Systems contains a vulnerability in the gfx_hotspot recipe, where an attacker could cause an OS command injection by supplying a malicious string to the process_nsys_rep_cli.py script if the script is invoked manually. A successful exploit of this vulnerability…

more

might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.

Deeper analysisAI

CVE-2025-33228 is an OS command injection vulnerability in NVIDIA Nsight Systems, specifically within the gfx_hotspot recipe of the process_nsys_rep_cli.py script. The issue arises when the script is invoked manually and supplied with a malicious string, potentially allowing arbitrary command execution. Published on 2026-01-20, it carries a CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) and is associated with CWE-78: Improper Neutralization of Special Elements used in an OS Command.

A local attacker with low privileges can exploit this vulnerability by tricking a user into manually executing the affected script with a crafted input string. Successful exploitation could result in code execution, privilege escalation, data tampering, denial of service, or information disclosure, depending on the attacker's goals and the system's configuration.

Mitigation guidance is provided in the NVIDIA security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5755, along with details in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-33228 and the CVE record at https://www.cve.org/CVERecord?id=CVE-2025-33228. Security practitioners should consult these advisories for patching instructions and workarounds.

Details

CWE(s)

Affected Products

nvidia
cuda toolkit
≤ 13.1.0

CVEs Like This One

CVE-2025-33230Same product: Nvidia Cuda Toolkit
CVE-2026-24154Same vendor: Nvidia
CVE-2025-33206Same vendor: Nvidia
CVE-2025-33180Same vendor: Nvidia
CVE-2026-24150Same vendor: Nvidia
CVE-2025-33229Same product: Nvidia Cuda Toolkit
CVE-2025-33253Same vendor: Nvidia
CVE-2025-33181Same vendor: Nvidia
CVE-2026-24165Same vendor: Nvidia
CVE-2026-24152Same vendor: Nvidia

References