CVE-2025-33230
Published: 20 January 2026
Summary
CVE-2025-33230 is a high-severity OS Command Injection (CWE-78) vulnerability in Nvidia Cuda Toolkit. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked at the 8.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-33230 affects the .run installer in NVIDIA Nsight Systems for Linux. The vulnerability enables OS command injection when an attacker supplies a malicious string to the installation path. Published on 2026-01-20 with a CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), it is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).
A local attacker with low privileges can exploit this vulnerability by tricking a user into specifying a malicious installation path during setup, which requires user interaction but has low complexity. Successful exploitation could result in escalation of privileges, arbitrary code execution, data tampering, denial of service, or information disclosure.
Mitigation details are available in official advisories, including the NVIDIA security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5755, the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-33230, and the CVE record at https://www.cve.org/CVERecord?id=CVE-2025-33230.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3353
Vulnerability details
NVIDIA Nsight Systems for Linux contains a vulnerability in the .run installer, where an attacker could cause an OS command injection by supplying a malicious string to the installation path. A successful exploit of this vulnerability might lead to escalation…
more
of privileges, code execution, data tampering, denial of service, and information disclosure.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection (CWE-78) in Linux installer directly enables Unix shell command execution (T1059.004) and local privilege escalation (T1068) via malicious path input.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the installation-path string to block special-element injection (CWE-78) that enables OS command execution.
Mandates prompt application of the vendor patch or updated .run installer that eliminates the command-injection flaw.
Limits privileges under which the installer runs, reducing the impact of successful path-based command injection to privilege escalation.