What is the CVSS score of CVE-2026-65168?

CVE-2026-65168 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

How to fix or mitigate CVE-2026-65168?

Within 24 hours, identify all NVIDIA Slurm deployments, restrict local login access to only essential personnel, and ensure that only trusted users can execute jobs on compute nodes. Within 7 days, implement mandatory monitoring for anomalous slurmstepd behavior, apply strict least-privilege controls to Slurm user accounts, and review authentication logs for suspicious activity. Within 30 days, engage NVIDIA support for patch status, deploy any vendor-recommended workarounds (e.g., disabling untrusted job submission or isolating slurmstepd with mandatory access controls), and develop a contingency plan for potential service interruption if exploitation occurs.

NVIDIA Slurm CVE-2026-65168

EUVD-2026-116016 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-11-03 nvidia

Buffer Overflow Heap Overflow Nvidia Slurm

7.0

CVSS 3.1 · Vendor: nvidia

View

Vulnerability Assessment

Weakness

CWE

CWE-122

ASVS 5.0

V15 - Secure Coding and Architecture Heap buffer bounds checking

MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Impact

The provided CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) is internally consistent with the description: slurmstepd runs on compute nodes (typically with elevated privileges), and a local vector with low-privilege requirement matches an authenticated user who already has job-submission or shell access to a node abusing the step daemon's socket handling. The AC:H signals that triggering the heap overflow reliably is non-trivial, though the available sources do not describe why it is hard to trigger. No EPSS score, no CISA KEV listing, and no POC reference are present in the input, so there is no exploitation-probability or in-the-wild signal to weigh - the vuln.today Decision label is 'this_week', indicating elevated but non-emergency priority rather than active-exploitation urgency. Net assessment: this is a genuine high-severity local privilege/impact issue on multi-tenant HPC clusters (where untrusted users routinely share compute nodes), but the local-only vector, low-privilege-but-not-zero prerequisite, and high attack complexity keep it below drop-everything urgency; absence of EPSS/KEV/POC data means real-world exploitation likelihood is currently unknown, not confirmed low.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Nov 03, 2026

Heap-based buffer overflow in the slurmstepd socket handling code of NVIDIA Slurm lets an authenticated local user corrupt heap memory, with the assessed CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) indicating high confidentiality, integrity, and availability impact. The affected product is captured by the wildcard CPE for nvidia:slurm, and no version-specific fixed release is present in the supplied data. No public exploit was identified at time of analysis, and the vuln.today decision label is this_week.

RemediationAI

No vendor-released patch or exact fixed version is identified in the available data, so no specific upgrade target can be cited; monitor the NVD and CVE.org records for an NVIDIA advisory and treat this as a tracking priority under the vuln.today this_week decision label. Because the assessed vector requires local access (AV:L) and low privileges (PR:L), the exposure-reduction measure most directly traceable to the assessment is to restrict compute-node shell and job-submission access to trusted users; this shrinks the pool of local users who could reach the slurmstepd socket handling path, but the sources do not confirm it prevents the heap overflow and it does not address the underlying defect. No verified configuration workaround is described in the supplied data, so exposure reduction should be paired with continued monitoring for a patched Slurm release.

Affected VersionsENISA

Slurm 25.11.0 through 25.11.7

Slurm 26.05.0 through 26.05.3

Slurm 25.05.0 through 25.05.8

Affected Packages

euvd slurm_25_05_0_through no fix

euvd slurm_25_11_0_through no fix

euvd slurm_26_05_0_through no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

NVIDIA Slurm is a workload manager for HPC clusters, and slurmstepd is the step daemon that runs on compute nodes, typically with elevated privileges as noted in the independent assessment. The flaw is classified as CWE-122 (heap-based buffer overflow) and sits in the slurmstepd socket handling code, meaning an attacker who can reach that local socket-handling path may be able to write beyond an allocated heap buffer. The CVSS vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H describes a local attack that requires low privileges and no user interaction, with high impact across confidentiality, integrity, and availability; the independent assessment maps the local, low-privilege prerequisite to a user who already has job-submission or shell access to a node. The available sources do not describe the exact trigger sequence, message contents, or heap layout needed to exploit the overflow, so the precise exploitation mechanics remain unverified in the supplied data.

Know when Slurm gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (nvidia) PRIMARY 7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (nvidia) · only source for this CVE.

CVSS VectorVendor: nvidia

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.

Executive ViewAI

Why It Matters

A heap-based buffer overflow in NVIDIA Slurm's slurmstepd component allows authenticated local users to corrupt heap memory, potentially leading to full system compromise with high impact on confidentiality, integrity, and availability. This affects organizations relying on Slurm for HPC workload management, where a malicious insider or compromised account could disrupt research, leak sensitive data, or cause service outages. Leadership should prioritize mitigation because the vulnerability is rated HIGH severity and no patch is currently available.

Business Impact: High

Compensating Controls

Restrict local access to Slurm nodes; enforce least privilege; monitor for heap corruption indicators; isolate slurmstepd via containerization or mandatory access controls; disable untrusted job submission until patch is available.

Threat Intelligence Overview

Data Quality

3 sources

Confidence: Low

EUVD

NVD

CVE.org

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS N/A

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +35

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.