What is the CVSS score of CVE-2026-24162?

CVE-2026-24162 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of NVIDIA Transformers4Rec are affected by CVE-2026-24162?

NVIDIA Merlin Transformers4Rec contains a high-severity insecure deserialization vulnerability enabling code execution when a local attacker tricks a user into loading a malicious serialized object.

How to fix or mitigate CVE-2026-24162?

24 hours: Identify all systems running NVIDIA Merlin Transformers4Rec (vulnerable: commits prior to March 11, 2026) and restrict local access via file permissions and login controls. 7 days: Implement monitoring for suspicious deserialization activity; restrict user ability to load untrusted serialized objects; isolate affected systems from production data networks if feasible. 30 days: Monitor NVIDIA's official releases for patched version (main branch contains fix post-March 11, 2026; await official release). Deploy immediately upon availability.

NVIDIA Transformers4Rec CVE-2026-24162

EUVD-2026-31854 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-05-26 nvidia

GHSA-xh7m-p996-h2f6

Information Disclosure Nvidia Deserialization RCE Merlin Transformers4Rec

7.8

CVSS 3.1 · Vendor: nvidia

Severity by source

Vendor (nvidia) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (nvidia) · only source for this CVE.

CVSS VectorVendor: nvidia

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:16 vuln.today

CVE Published

May 26, 2026 - 16:12 nvd

HIGH 7.8

DescriptionCVE.org

NVIDIA Transformers4Rec for Linux contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

AnalysisAI

Insecure deserialization in NVIDIA Merlin Transformers4Rec on Linux allows a local attacker to achieve code execution, data tampering, and information disclosure by tricking a user into loading a malicious serialized object. The flaw affects all Main-branch commits prior to March 11, 2026, and currently has no public exploit identified at time of analysis, with a very low EPSS score (0.02%) reflecting limited real-world activity. CISA SSVC classifies exploitation as 'none' but technical impact as 'total', placing it firmly in the supply-chain/MLOps risk category rather than a mass-exploitation threat.

Technical ContextAI

Transformers4Rec is NVIDIA's Merlin-family open-source library that adapts Hugging Face Transformer architectures for sequential and session-based recommendation systems, typically used inside data science pipelines and model training workflows on Linux. The root cause is CWE-502 (Deserialization of Untrusted Data), which in the Python/ML ecosystem usually manifests through pickle, torch.load, joblib, or similar serialization formats that execute arbitrary code on object reconstruction. The affected CPE cpe:2.3:a:nvidia:merlin_transformers4rec:*:*:* covers all versions up to the March 11, 2026 main-branch fix, indicating the library deserializes attacker-controlled artifacts (likely model checkpoints, configs, or dataset metadata) without validation before instantiation.

RemediationAI

Upstream fix available (commit on Main dated March 11, 2026); released patched version not independently confirmed in the supplied data, so consult NVIDIA advisory 5838 at https://nvidia.custhelp.com/app/answers/detail/a_id/5838 for the exact tagged release and update Transformers4Rec to that build. Until upgrading, only load model checkpoints, tokenizers, and dataset artifacts from trusted internal sources - never from public Hugging Face mirrors, shared notebooks, or untrusted contributors - and consider running training and inference jobs in disposable containers or sandboxes (e.g., gVisor, rootless containers) so a successful pickle gadget cannot reach production data; the trade-off is added CI complexity and slower iteration. Where feasible, switch serialization formats for in-house artifacts to safetensors, which is not vulnerable to arbitrary code execution on load, accepting that this requires re-exporting existing checkpoints.