CVE-2025-33234
Published: 27 January 2026
Summary
CVE-2025-33234 is a high-severity OS Command Injection (CWE-78) vulnerability in Custhelp (inferred from references). Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 3.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-33234 is a code injection vulnerability (CWE-78) in NVIDIA runx, published on 2026-01-27. The flaw allows an attacker to inject code, potentially resulting in code execution, denial of service, escalation of privileges, information disclosure, and data tampering. It has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity with local attack vector, low complexity, and low privileges required.
A local attacker with low-level privileges can exploit this vulnerability without user interaction. Successful exploitation enables arbitrary code execution, denial of service, privilege escalation, information disclosure, and data tampering on the affected system.
Mitigation details are available in official advisories, including the NVIDIA security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5764, the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-33234, and the CVE record at https://www.cve.org/CVERecord?id=CVE-2025-33234. Security practitioners should consult these for patching instructions and workarounds.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206385
Vulnerability details
NVIDIA runx contains a vulnerability where an attacker could cause a code injection. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CWE-78 OS command injection directly enables arbitrary command execution (T1059) and is explicitly described as leading to privilege escalation (T1068) with local low-priv access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents code injection (CWE-78) in NVIDIA runx by requiring validation and sanitization of all inputs to block malicious code insertion.
Mandates timely flaw remediation, including patching this specific code injection vulnerability in NVIDIA runx as detailed in official advisories.
Enforces least privilege to restrict the impact of local low-privilege exploitation, limiting privilege escalation, code execution, and data tampering resulting from the injection.