Command Injection Vulnerability in NVIDIA Nsight Systems
CVE-2025-33228

7.3HIGH

Key Information:

Vendor

Nvidia
Status
Cuda Toolkit
Vendor
CVE Published:
20 January 2026

What is CVE-2025-33228?

NVIDIA Nsight Systems has a vulnerability in the gfx_hotspot recipe that can be exploited through OS command injection. An attacker may supply a crafted string to the process_nsys_rep_cli.py script, which, when invoked manually, allows execution of arbitrary commands. This vulnerability can lead to serious consequences, including unauthorized code execution, privilege escalation, potential data tampering, denial of service, and exposure of sensitive information.

Affected Version(s)

CUDA Toolkit Windows All versions prior to CUDA Toolkit 13.1

References

https://nvd.nist.gov/vuln/detail/CVE-2025-33228
https://www.cve.org/CVERecord?id=CVE-2025-33228
https://nvidia.custhelp.com/app/answers/detail/a_id/5755

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.