CVE-2026-24263
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause a NULL pointer dereference. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering.
Risk Assessment
The vulnerability could allow a privileged attacker to cause a system crash or potentially gain control, potentially leading to security compromise.
Recommendation
It is recommended to apply patches provided by NVIDIA for the DGX Spark system. Also, monitor the system for unusual behavior.
Other vulnerabilities in NVIDIA DGX Spark
See all- CVE-2026-47626High
NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering.
- CVE-2026-47624Medium
NVIDIA DGX Spark contains a vulnerability in UEFI where a privileged local user can cause a CWE-693, potentially allowing bypass of administrator password protection in UEFI. Successful exploitation may allow an attacker to bypass password protections.
- CVE-2026-24262High
NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering.
- CVE-2026-24225Medium
NVIDIA DGX Spark contains a vulnerability in the standalone MM firmware where an attacker could cause an out-of-bounds read. Successful exploitation might lead to information disclosure.
Original NVD description (English source)
NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause a NULL pointer dereference. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering.