What is the CVSS score of CVE-2026-24255?

CVE-2026-24255 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of NVIDIA Dynamo are affected by CVE-2026-24255?

NVIDIA Dynamo's multimodal embedding cache on Linux is vulnerable to unauthenticated remote cache corruption attacks where specially crafted images corrupt cached inference data, causing AI models to…

How to fix or mitigate CVE-2026-24255?

Within 24 hours, inventory all NVIDIA Dynamo deployments on Linux systems, identify network-accessible instances in production inference pipelines, and document current versions and cache configurations. Within 7 days, restrict network access to Dynamo endpoints through firewall rules or VPC isolation, enforce API-level authentication if not already present, and enable request logging to detect anomalous image submissions. Within 30 days, monitor NVIDIA security advisories for patch release timelines, evaluate embedding output validation mechanisms to detect cache corruption, and develop an upgrade plan for when vendor patches are released.

NVIDIA Dynamo CVE-2026-24255

EUVD-2026-52803 HIGH

Incomplete Comparison with Missing Factors (CWE-1023)

2026-08-04 nvidia

GHSA-xm83-6w9c-39px

Information Disclosure Nvidia Dynamo

7.5

CVSS 3.1 · Vendor: nvidia

Severity by source

Vendor (nvidia) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Network submission of crafted images requires no authentication in an exposed API; dimensions omission from hash causes high integrity impact with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (nvidia).

CVSS VectorVendor: nvidia

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 18:03 vuln.today

CVE Published

Aug 04, 2026 - 17:23 cve.org

HIGH 7.5

DescriptionCVE.org

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submitting images that share an identical pixel byte sequence but have different dimensions. A successful exploit of this vulnerability might lead to data tampering.

AnalysisAI

Hash collision exploitation in NVIDIA Dynamo's multimodal embedding cache on Linux allows unauthenticated remote attackers to corrupt cached inference data by submitting specially crafted images. The cache fails to incorporate image dimensions into its hash function, meaning two images with identical pixel byte sequences but different spatial dimensions resolve to the same cache key, causing the wrong embedding to be served for subsequent requests. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the CVSS score of 7.5 with no authentication requirement (PR:N) elevates its priority in deployments where the inference API is network-accessible.

Technical ContextAI

NVIDIA Dynamo is a high-performance AI inference serving framework designed for large-scale GPU-accelerated model deployment. Its multimodal embedding cache stores precomputed vector embeddings for input modalities such as images to avoid redundant inference passes. The root cause maps to CWE-1023 (Incomplete Comparison with Missing Factors): the cache key derivation hashes only the raw pixel byte sequence without incorporating image metadata such as width and height. This means two semantically distinct images - e.g., a 4x8 pixel image and an 8x4 pixel image sharing the same flat byte array - are treated as identical by the cache. Affected product scope per CPE is cpe:2.3:a:nvidia:dynamo:*:*:*:*:*:*:*:*, indicating all tracked versions of Dynamo on Linux are in scope.

RemediationAI

The primary remediation is to apply the patch referenced in NVIDIA's product security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5842. An exact fixed version number is not independently confirmed from the available data - consult the advisory directly to identify the patched release. Upstream fix availability should be verified against the NVIDIA/product-security repository before deployment. As a compensating control pending patching, operators can restrict network access to the Dynamo inference API to trusted internal clients or authenticated service accounts, which would neutralize the PR:N attack path by requiring some form of credentials. Additionally, if the multimodal embedding cache can be disabled via configuration without an unacceptable performance impact, doing so eliminates the vulnerable code path entirely - though this trades inference throughput for security and should be evaluated against workload requirements.