CVE-2025-33231

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2026-01-20

Last updated on: 2026-02-02

Assigner: NVIDIA Corporation

Description

NVIDIA Nsight Systems for Windows contains a vulnerability in the application’s DLL loading mechanism where an attacker could cause an uncontrolled search path element by exploiting insecure DLL search paths. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service and information disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-20

Last Modified

2026-02-02

Generated

2026-07-06

AI Q&A

2026-01-20

EPSS Evaluated

2026-07-05

NVD

CVE-2025-33231

EUVD

EUVD-2026-3375

Affected Vendors & Products

Vendor	Product	Version / Range
nvidia	cuda_toolkit	to 13.1.0 (exc)
microsoft	windows	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-427	The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

Attack-Flow Graph

Impact Analysis

Exploitation of this vulnerability can lead to serious impacts including execution of arbitrary code, escalation of privileges, data tampering, denial of service, and information disclosure. This affects the confidentiality, integrity, and availability of the system, potentially compromising system security and user data. [1, 2]

Mitigation Strategies

To mitigate this vulnerability, upgrade NVIDIA Nsight Systems for Windows to CUDA Toolkit version 13.1 or later, as this version addresses the insecure DLL loading mechanism causing the vulnerability. [1]

Executive Summary

This vulnerability in NVIDIA Nsight Systems for Windows is due to an insecure DLL loading mechanism where the application uses uncontrolled search path elements. An attacker with local access and low privileges, requiring user interaction, could exploit this flaw to execute arbitrary code, escalate privileges, tamper with data, cause denial of service, or disclose information. It is classified under CWE-427 (Uncontrolled Search Path Element). [1, 2]

Hi! I’m here to help you understand CVE-2025-33231. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70