CVE-2025-33234

High

Published: 27 January 2026

Published

27 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0001 1.0th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-33234 is a high-severity OS Command Injection (CWE-78) vulnerability in Custhelp (inferred from references). Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 1.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Command and Scripting Interpreter (T1059) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly prevents code injection (CWE-78) in NVIDIA runx by requiring validation and sanitization of all inputs to block malicious code insertion.

SI-2 Flaw Remediation good match

prevent

Mandates timely flaw remediation, including patching this specific code injection vulnerability in NVIDIA runx as detailed in official advisories.

AC-6 Least Privilege partial match

prevent

Enforces least privilege to restrict the impact of local low-privilege exploitation, limiting privilege escalation, code execution, and data tampering resulting from the injection.

MITRE ATT&CK Enterprise TechniquesAI

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

CWE-78 OS command injection directly enables arbitrary command execution (T1059) and is explicitly described as leading to privilege escalation (T1068) with local low-priv access.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

NVIDIA runx contains a vulnerability where an attacker could cause a code injection. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

Deeper analysisAI

CVE-2025-33234 is a code injection vulnerability (CWE-78) in NVIDIA runx, published on 2026-01-27. The flaw allows an attacker to inject code, potentially resulting in code execution, denial of service, escalation of privileges, information disclosure, and data tampering. It has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity with local attack vector, low complexity, and low privileges required.

A local attacker with low-level privileges can exploit this vulnerability without user interaction. Successful exploitation enables arbitrary code execution, denial of service, privilege escalation, information disclosure, and data tampering on the affected system.

Mitigation details are available in official advisories, including the NVIDIA security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5764, the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-33234, and the CVE record at https://www.cve.org/CVERecord?id=CVE-2025-33234. Security practitioners should consult these for patching instructions and workarounds.