CVE-2026-24228

NVIDIA NeMo Framework for Linux contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, data tampering, and information disclosure.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://nvd.nist.gov/vuln/detail/CVE-2026-24228	US Government Resource
https://nvidia.custhelp.com/app/answers/detail/a_id/5839	Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2026-24228	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nvidia:nemo:*:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) NVIDIA NeMo Framework para Linux contiene una vulnerabilidad donde un atacante puede causar la deserialización de datos no confiables. Un exploit exitoso de esta vulnerabilidad puede conducir a la ejecución de código, escalada de privilegios, manipulación de datos y revelación de información.

Information

Published : 2026-06-16 17:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-24228

Mitre link : CVE-2026-24228

CVE.ORG link : CVE-2026-24228

JSON object : View

Products Affected

nvidia

nemo

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-24228", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24228", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-16T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@nvidia.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "psirt@nvidia.com", "affectedData": [{"vendor": "NVIDIA", "product": "NeMo Framework", "versions": [{"status": "affected", "version": "Versions 0.0 to 2.7.2"}], "platforms": ["All platforms"], "defaultStatus": "unaffected"}]}], "published": "2026-06-16T17:16:39.590", "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24228", "tags": ["US Government Resource"], "source": "psirt@nvidia.com"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5839", "tags": ["Vendor Advisory"], "source": "psirt@nvidia.com"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-24228", "tags": ["Third Party Advisory"], "source": "psirt@nvidia.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@nvidia.com", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "NVIDIA NeMo Framework for Linux contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, data tampering, and information disclosure."}, {"lang": "es", "value": "NVIDIA NeMo Framework para Linux contiene una vulnerabilidad donde un atacante puede causar la deserializaci\u00f3n de datos no confiables. Un exploit exitoso de esta vulnerabilidad puede conducir a la ejecuci\u00f3n de c\u00f3digo, escalada de privilegios, manipulaci\u00f3n de datos y revelaci\u00f3n de informaci\u00f3n."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nvidia:nemo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "84801C7C-6EF0-42DB-A099-EFDB62A7895D", "versionEndExcluding": "2.7.3"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@nvidia.com"}