CVE-2025-33230
BaseFortify
Publication date: 2026-01-20
Last updated on: 2026-02-02
Assigner: NVIDIA Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nvidia | cuda_toolkit | to 13.1.0 (exc) |
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the NVIDIA Nsight Systems for Linux .run installer, where an attacker can supply a malicious string as the installation path, causing an OS command injection. This means the attacker can execute arbitrary operating system commands during installation, potentially leading to privilege escalation, code execution, data tampering, denial of service, and information disclosure. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker to escalate their privileges on the system, execute arbitrary code, tamper with data, cause denial of service, and disclose sensitive information. These impacts can compromise system security, data integrity, and availability. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the NVIDIA Nsight Systems for Linux .run installer is present and if it has been executed with potentially malicious installation paths. Since the vulnerability involves OS command injection via the installation path, monitoring or auditing installation commands for unusual or suspicious path strings could help detect exploitation attempts. Specific commands to detect this vulnerability are not provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding running the NVIDIA Nsight Systems .run installer with untrusted or user-supplied installation paths, restricting local user access to the installer, and applying any patches or updates released by NVIDIA addressing this vulnerability. Since the vulnerability requires local access and user interaction, limiting local user privileges and monitoring installation activities can reduce risk. [1]