NVIDIA runx Code Injection Vulnerability Raises High Risk

A high severity vulnerability has been identified in NVIDIA runx, an unmaintained component now declared end-of-life. The flaw allows code injection, which could result in arbitrary code execution, privilege escalation, denial of service, information disclosure, or data tampering. NVIDIA has confirmed that runx is no longer supported and that no security patches will be issued. All Linux versions of NVIDIA runx are affected. There are currently no reports of exploitation in the wild; however, the absence of vendor support significantly increases long-term risk.

CVE
CVE-2025-33234

Targeting / Delivery Mechanism
The vulnerability may be exploited by supplying crafted input to the vulnerable component, triggering unintended command or code execution. Systems exposing runx functionality to untrusted inputs or shared environments may present higher risk.

Execution Technique
The issue stems from improper input handling that enables code injection. An attacker could manipulate input in a way that causes arbitrary commands to execute within the context of the application, potentially escalating privileges depending on runtime configuration.

Persistence / Deployment
If exploited, attackers could execute malicious payloads, create privileged accounts, modify system files, or deploy persistence mechanisms, particularly if runx operates with elevated privileges.