What is the CVSS score of EUVD-2026-15015?

EUVD-2026-15015 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Nvidia are affected by EUVD-2026-15015?

NVIDIA NeMo Framework installations face a HIGH severity vulnerability (CVE-2026-24159) allowing authenticated attackers to execute arbitrary code with total technical impact.. A patch is available.

How to fix or mitigate EUVD-2026-15015?

Within 24 hours: Inventory all systems running NVIDIA NeMo Framework and restrict access to authenticated users only. Within 7 days: Implement network segmentation to isolate NeMo deployments and disable unnecessary deserialization features if possible. Within 30 days: Monitor NVIDIA security advisories for patch availability and establish a deployment plan; evaluate alternative frameworks if patch timeline extends beyond acceptable risk tolerance.

Nvidia EUVD-2026-15015

| CVE-2026-24159 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-24 nvidia

GHSA-v7v2-m736-cf3c

RCE Information Disclosure Nvidia Deserialization

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 02, 2026 - 14:30 nvd

Patch available

EUVD ID Assigned

Mar 24, 2026 - 20:31 euvd

EUVD-2026-15015

Analysis Generated

Mar 24, 2026 - 20:31 vuln.today

CVE Published

Mar 24, 2026 - 20:27 nvd

HIGH 7.8

DescriptionCVE.org

NVIDIA NeMo Framework contains a vulnerability where an attacker may cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure and data tampering.

AnalysisAI

NVIDIA NeMo Framework contains an insecure deserialization vulnerability (CWE-502) that allows authenticated local attackers to execute arbitrary code. The vulnerability affects NVIDIA NeMo Framework installations and can lead to code execution, privilege escalation, information disclosure, and data tampering. According to CISA's SSVC framework, there is currently no evidence of active exploitation in the wild, and the attack is not automatable, though technical impact is rated as total.

Technical ContextAI

This vulnerability stems from insecure deserialization (CWE-502), a class of flaws where an application deserializes untrusted data without proper validation, allowing attackers to manipulate serialized objects to execute arbitrary code. NVIDIA NeMo Framework is an end-to-end platform for developing and customizing generative AI models, including large language models and speech AI. The affected product is identified via CPE as cpe:2.3:a:nvidia:nemo_framework. Deserialization vulnerabilities typically occur when applications use serialization libraries (such as Python's pickle, or similar mechanisms) to reconstruct objects from data streams without adequately sanitizing or validating the input, enabling attackers to inject malicious payloads that execute during the deserialization process.

RemediationAI

Consult NVIDIA's official security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5800 for specific patch versions and upgrade instructions for NeMo Framework. Apply the vendor-provided security updates immediately, prioritizing systems where multiple users have local access or where NeMo Framework processes untrusted input data. Until patching is complete, implement defense-in-depth controls including restricting local access to NeMo Framework installations to only trusted administrators, monitoring for unusual process execution or privilege escalation attempts, and avoiding processing of untrusted serialized data. Review application logs for suspicious deserialization activity and consider implementing application-level controls to validate serialized data sources.