EUVD-2026-98547
GHSA-5w2q-fr75-hwg5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privilege access
-
DeliveryCraft malicious input file or dataset
-
ExploitVictim loads data via DALI pipeline
-
ExecutionTrigger out-of-bounds write in parser/decoder
-
ImpactDoS, memory disclosure, or data tampering
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires LOCAL access (AV:L) by an attacker who already holds low-level privileges (PR:L) AND requires user interaction (UI:R): a victim/process must load or decode attacker-controlled input data (such as a malicious image, media file, or dataset record) through a DALI data-loading/augmentation pipeline. The flaw is NOT remotely exploitable and does not apply to default configurations that only process trusted, in-house data - the key limiting factor is that a DALI pipeline must ingest attacker-influenced input. Realistic risk is therefore concentrated in multi-tenant training clusters, pipelines consuming externally-sourced datasets, or services that let users submit media for GPU preprocessing. The precise vulnerable operator/codec and the exact affected version range are not stated in the available data. |
| Impact | This is a moderate-severity, locally-exploitable memory-corruption flaw (CWE-787 out-of-bounds write) in NVIDIA DALI, vendor-rated 7.3 with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. The CVSS profile is the dominant signal and it points to constrained real-world risk: the attack vector is LOCAL (AV:L), the attacker needs existing low-level privileges (PR:L), and user interaction is required (UI:R) - meaning a victim must load or process attacker-influenced data through a DALI pipeline. No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization; no public exploit identified at time of analysis. The high C/I/A impacts justify the elevated base score, but combined AV:L + PR:L + UI:R make opportunistic or mass exploitation unlikely - this is far from a network-facing, unauthenticated critical. There is no SSVC decision data or exploitation-maturity signal in the input to refine this further. Net assessment: a legitimate issue to patch in ML/data-processing environments, but not an emergency relative to remotely-exploitable flaws; priority should be driven by whether DALI pipelines ingest untrusted input. |
| Exploit ScenarioDerived | An attacker with local, low-privilege access on a machine running an ML/data-preprocessing workload crafts a malicious input (e.g. a specially-formed image, media file, or dataset entry) that is then loaded and decoded by a DALI data pipeline. Processing the crafted input triggers an uncontrolled out-of-bounds write, corrupting memory to cause a crash (denial of service), leak adjacent memory (information disclosure), or tamper with data. No public proof-of-concept was identified in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
An uncontrolled out-of-bounds write in NVIDIA DALI (the Data Loading Library used for GPU-accelerated data preprocessing) allows a locally positioned attacker who already holds low-level privileges to corrupt process memory when a DALI pipeline loads or decodes attacker-influenced input such as a crafted image, media file, or dataset record. A successful exploit can produce denial of service, information disclosure, and data tampering, consistent with the vendor rating of 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), which requires local access, low privileges, and user interaction (a victim or process must ingest the malicious data). There is no CISA KEV listing and no public exploit identified at time of analysis, so practical risk is concentrated in multi-tenant training clusters, pipelines consuming externally sourced datasets, and services that accept user-submitted media for GPU preprocessing rather than in default in-house-only deployments.
RemediationAI
No vendor-released patch version is confirmed in the available data, so the first step is to consult NVIDIA's advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5900 (also mirrored at https://nvd.nist.gov/vuln/detail/CVE-2026-65149) and upgrade DALI to the release NVIDIA lists as fixed as soon as it is published; do not assume an arbitrary newer build resolves the flaw, since the affected range is not enumerated in the data provided. Until a fixed build is confirmed, apply compensating controls that address the actual precondition - a DALI pipeline ingesting attacker-influenced data. Isolate decoding and augmentation of untrusted media in a separate, least-privilege process or container with no access to sensitive datasets or credentials, accepting the trade-off of added latency and more complex GPU sharing; where feasible, pre-validate or re-encode untrusted files with a hardened decoder before handing them to DALI, at the cost of extra CPU work and possible rejection of edge-case files that are legitimately valid; restrict which principals or tenants may submit datasets or media into shared training/preprocessing clusters, which reduces exposure but limits self-service workflows; and run pipelines under a dedicated non-root service account with ASLR and standard memory-hardening enabled, which raises the bar for turning the out-of-bounds write into a stable primitive without affecting functionality. Because exploitation requires local access, low privileges, and user interaction, reducing the set of untrusted-input paths into DALI yields the most immediate risk reduction while a vendor fix is awaited.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NVIDIA DALI is a GPU-accelerated data loading and augmentation library for deep learning pipelines; it exposes a large set of decoders and operators (image, video, audio, and general tensor operators) that parse external files and dataset records on the host and then move results to the GPU. The root cause class is CWE-787 (out-of-bounds write), meaning a size, offset, or length value derived from attacker-controlled input is used to write past the boundary of an allocated buffer instead of being validated against the destination buffer capacity. Because the flaw lives in data-parsing/copying logic, exploitation depends on the pipeline ingesting attacker-influenced data: a poisoned dataset entry, a crafted media file, or user-submitted content routed through a DALI decoding or augmentation stage. The CPE string cpe:2.3:a:nvidia:dali:*:*:*:*:*:*:*:* uses a wildcard version, indicating that the CPE feed tracks the product generically and does not pin a specific release; the available data does not identify the precise vulnerable operator or codec, nor the exact affected version range, so the exposure window cannot be narrowed further from the provided sources. The assessed vector is local (AV:L), low-privilege (PR:L), and requires user interaction (UI:R), with scope unchanged (S:U) and high confidentiality, integrity, and availability impact - a memory-corruption primitive that is not remotely reachable on its own.
Know when Dali gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Out-of-bounds write is reached only locally by processing crafted input, so AV:L/UI:R; it affects an authenticated/low-priv context (PR:L), yielding full C/I/A impact in-process.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
DescriptionCVE.org
NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service, information disclosure, and data tampering.
Articles & Coverage 1
Executive ViewAI
NVIDIA DALI, the GPU-accelerated data loading library used in AI/ML pipelines, has a high-severity memory corruption vulnerability that can be triggered when a pipeline processes untrusted images, media, or dataset records. The business risk is concentrated in shared or multi-tenant training environments and services that accept external data or user-submitted media, where exploitation could cause service disruption, data tampering, or information disclosure; no public exploit has been identified at time of analysis and no vendor-released patch is identified at time of analysis. Leadership should prioritize visibility and containment because affected preprocessing jobs often run with access to valuable training data and shared GPU infrastructure.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting NVIDIA DALI preprocessing to trusted inputs, validating and sanitizing externally sourced images, media, and dataset records before ingestion, isolating or sandboxing DALI pipelines and GPU nodes with least-privilege access, monitoring for crashes or memory anomalies, and applying the vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
An uncontrolled out-of-bounds read in NVIDIA DALI (Data Loading Library) can be triggered when a low-privileged local us
An uncontrolled out-of-bounds read in NVIDIA DALI is triggered while the library parses attacker-supplied data inside a
Arbitrary code execution in NVIDIA DALI (all versions prior to 2.0) allows local authenticated attackers with low privil
Heap-based buffer overflow in NVIDIA DALI enables local authenticated attackers to achieve code execution, data tamperin
Local code execution and data tampering in NVIDIA DALI (Data Loading Library) is possible when a low-privileged user is
Stack-based buffer overflow in NVIDIA DALI lets a locally authenticated, low-privileged user who can get a crafted input
Exploit-DB