CVE-2026-24252
HighCVSS 7.8Exploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
A vulnerability in NVIDIA NeMo for Linux allows an attacker to cause OS command injection, potentially leading to code execution, data tampering, privilege escalation, and information disclosure.
Risk Assessment
Attackers can gain full control over the system, posing a serious threat to data confidentiality, integrity, and availability.
Recommendation
Immediately update NVIDIA NeMo to the latest version containing a security fix.
Other vulnerabilities in NVIDIA NeMo
See all- CVE-2026-65179High
NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controlled .pkl file via pickle.load() without validation. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure.
- CVE-2026-65178High
NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model_config.yaml can inject unsafe parameters. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure.
- CVE-2025-33205High
NVIDIA NeMo framework contains a vulnerability in a predefined variable, where an attacker could cause inclusion of functionality from an untrusted control sphere by use of a predefined variable. A successful exploit of this vulnerability may lead to code execution.
Original NVD description (English source)
NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A successful exploit of this vulnerability may lead to code execution, data tampering, escalation of privileges and information disclosure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS