What is the CVSS score of CVE-2026-24216?

CVE-2026-24216 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Bionemo Framework are affected by CVE-2026-24216?

NVIDIA BioNemo Framework on Linux contains a HIGH-severity arbitrary code execution vulnerability (CVE-2026-24216) through unsafe deserialization, exploitable by local attackers during normal…

How to fix or mitigate CVE-2026-24216?

Within 24 hours: Inventory all systems running NVIDIA BioNemo Framework; restrict local user access and apply OS-level least-privilege controls (dedicate to a service account with minimal permissions). Within 7 days: Enable security event logging and alerting for unexpected process execution and file access from BioNemo processes; audit local user access logs over the past 30 days. Within 30 days: Contact NVIDIA for patch availability timeline and ETA; evaluate whether BioNemo can be disabled if not actively required; assess feasibility of isolated or air-gapped deployment if continued operation is necessary.

Bionemo Framework CVE-2026-24216

EUVD-2026-31143 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-05-20 nvidia

GHSA-mfc6-w69g-6wj5

RCE Denial Of Service Information Disclosure Deserialization Nvidia Bionemo Framework

7.8

CVSS 3.1 · Vendor: nvidia

Severity by source

Vendor (nvidia) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (nvidia) · only source for this CVE.

CVSS VectorVendor: nvidia

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 20:00 vuln.today

DescriptionCVE.org

NVIDIA BioNemo for Linux contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.

AnalysisAI

Arbitrary code execution in NVIDIA BioNemo Framework on Linux allows a local attacker to abuse unsafe deserialization of untrusted data (CWE-502), leading to code execution, denial of service, information disclosure, and data tampering. The CVSS 7.8 vector indicates local attack vector with required user interaction, and no public exploit has been identified at time of analysis.