What is the CVSS score of CVE-2026-24221?

CVE-2026-24221 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of NVIDIA NVTabular are affected by CVE-2026-24221?

NVIDIA NVTabular contains a local code execution vulnerability that allows authenticated users to compromise system integrity, manipulate data, and steal sensitive information.

How to fix or mitigate CVE-2026-24221?

Within 24 hours: Audit all deployed NVTabular instances and document current versions. Within 7 days: Restrict authenticated access to minimum required users, implement filesystem isolation for NVTabular processes, and disable deserialization of untrusted data where operationally viable. Within 30 days: Monitor NVIDIA advisories for patch availability and develop an upgrade roadmap.

NVIDIA NVTabular CVE-2026-24221

EUVD-2026-33984 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-02 nvidia

GHSA-hj75-h2wq-2xm2

Nvidia RCE Deserialization Information Disclosure Nvtabular

7.8

CVSS 3.1 · Vendor: nvidia

Severity by source

Vendor (nvidia) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (nvidia) · only source for this CVE.

CVSS VectorVendor: nvidia

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 17:30 vuln.today

DescriptionCVE.org

NVIDIA NVTabular contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering and information disclosure.

AnalysisAI

Local code execution in NVIDIA NVTabular allows an authenticated low-privileged user to abuse improper deserialization of untrusted data to run arbitrary code, tamper with data, and disclose sensitive information. The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N) reflecting a local attack vector with low complexity and low privileges; no public exploit identified at time of analysis and the issue is not on the CISA KEV list.

Technical ContextAI

NVTabular is NVIDIA's GPU-accelerated feature-engineering library for tabular data, part of the Merlin recommender ecosystem, commonly used by data scientists to build preprocessing pipelines that are serialized to disk (typically as Python pickle artifacts) and reloaded for training or inference. The root cause is CWE-502 (Deserialization of Untrusted Data): when NVTabular reconstructs a workflow, preprocessing object, or pipeline artifact from an untrusted file, the deserializer instantiates attacker-controlled objects whose magic methods (e.g., __reduce__ in pickle) execute arbitrary Python code in the host process. The affected CPE is cpe:2.3:a:nvidia:nvtabular:*:*:*:*:*:*:*:* with the version range left open, indicating the vendor has not narrowed the affected range in NVD at publication.

RemediationAI

Upgrade NVTabular to the fixed release identified in NVIDIA security bulletin a_id/5851 (https://nvidia.custhelp.com/app/answers/detail/a_id/5851) - the exact fix version is not reproduced in the provided data, so consult that advisory for the precise build, and rebuild any Merlin or custom container images that pin a vulnerable NVTabular wheel. As a compensating control until upgrade, treat NVTabular workflow/pipeline artifacts (pickle, joblib, parquet-with-metadata) as untrusted code: load them only from integrity-checked, signed, or hash-pinned sources, and execute load operations in an isolated, non-privileged sandbox (separate UID, no network egress, read-only mounts for shared datasets) so that arbitrary-code execution cannot pivot into the broader training environment. Operationally, restrict who can write to model/artifact stores and add allowlisting on artifact origin in CI/CD; the trade-off is that legitimate data scientists may need a vetting step before previously-ad-hoc artifacts can be loaded.