NVIDIA Alert: High-Severity Code Execution Flaws Hit CUDA Toolkit

NVIDIA has rolled out a critical update for its CUDA Toolkit, patching four high-severity vulnerabilities that could allow arbitrary code execution and privilege escalation on Windows and Linux systems. The flaws affect “All versions up to CUDA Toolkit 13.1,” exposing developers and researchers using the parallel computing platform to significant risks.

One of the headline flaws, CVE-2025-33228, targets NVIDIA Nsight Systems and could cause an OS command injection by supplying a malicious string to the process_nsys_rep_cli.py script if invoked manually, with a CVSS of 7.3. The update also fixes issues in Visual Studio Monitor (CVE-2025-33229) and the Linux Installer (CVE-2025-33230), both rated with CVSS 7.3, and a Windows-specific flaw (CVE-2025-33231) involving an uncontrolled search path element, or DLL hijacking, rated CVSS 6.7. NVIDIA advises upgrading to CUDA Toolkit 13.1 to mitigate these threats, noting that earlier releases are affected as well.