This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] NVIDIA fixes 5 vulnerabilities

NVIDIA fixes 5 vulnerabilities in NVIDIA Merlin Transformers4Rec and NVIDIA CUDA Toolkit. The most severe are described below; the rest can be found at [1][2]. Products and their fixes: NVIDIA Merlin Transformers4Rec - all versions that contain commit 27ddd49 [1] NVIDIA CUDA Toolkit - 13.1 [2]

NVIDIA Merlin - code execution, escalation of privileges, information disclosure, data tampering (CVE-2025-33233)
CVSS 7.8 (High)

Due to a vulnerability in NVIDIA Merlin Transformers4Rec for all platforms, an authenticated local attacker can achieve code execution, escalation of privileges, information disclosure or data tampering through code injection [1].

The vulnerability is present in product:

  • NVIDIA Merlin Transformers4Rec;

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 20. 1. 2026.

NVIDIA CUDA Toolkit - code execution, escalation of privileges, data tampering, denial of service, information disclosure (CVE-2025-33228)
CVSS 7.3 (High)

Due to a vulnerability in gfx_hotspot in NVIDIA Nsight Systems, an authenticated local attacker can achieve code execution, escalation of privileges, data tampering, denial of service or information disclosure through command injection when the script process_nsys_rep_cli.py is run manually [2].

The vulnerability is present in product:

  • NVIDIA CUDA Toolkit; <13.1

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

More information:

  • CVE-2025-33228 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 20. 1. 2026.

NVIDIA CUDA Toolkit - code execution, escalation of privileges, data tampering, denial of service, information disclosure (CVE-2025-33229)
CVSS 7.3 (High)

Due to a vulnerability in the Nsight Monitor component in NVIDIA Nsight Visual Studio for Windows, an authenticated local attacker can execute arbitrary code with the same privileges as the NVIDIA Nsight Visual Studio Edition Monitor application, which can lead to escalation of privileges, code execution, data tampering, denial of service or information disclosure [2].

The vulnerability is present in product:

  • NVIDIA CUDA Toolkit; <13.1

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 20. 1. 2026.

By CESNET, z.s.p.o. Michaela Jarošová on 23. 1. 2026.

CESNET, z.s.p.o. Logo