Skip to content
OpenAdvisories
High · 7.3 CVE-2025-33228 EUVD-2026-3357GHSA-p5c4-pcw7-pqff

NVIDIA Nsight Systems contains a vulnerability in the gfx_hotspot recipe, where an attacker could cause an OS command injection by supplyin…

Published Jan 20, 2026 · Updated Feb 26, 2026 · Assigned by nvidia

Description

NVIDIA Nsight Systems contains a vulnerability in the gfx_hotspot recipe, where an attacker could cause an OS command injection by supplying a malicious string to the process_nsys_rep_cli.py script if the script is invoked manually. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.

Affected products

VendorProductAffectedFixed
NVIDIA CUDA Toolkit All versions prior to CUDA Toolkit 13.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 13 nvidia-cuda-toolkit No fix yet —
Debian 12 nvidia-cuda-toolkit No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 nvidia-cuda-toolkit No fix yet —
Ubuntu 26.04 LTS nvidia-cuda-toolkit No fix yet —
Ubuntu 25.10 nvidia-cuda-toolkit No fix yet —
Ubuntu 24.04 LTS nvidia-cuda-toolkit No fix yet —
Ubuntu 22.04 LTS nvidia-cuda-toolkit No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS nvidia-cuda-toolkit No fix yet —
Ubuntu 18.04 LTS nvidia-cuda-toolkit No fix yet —
Ubuntu 16.04 LTS nvidia-cuda-toolkit No fix yet —

References