What is the CVSS score of EUVD-2026-17514?

EUVD-2026-17514 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Nvidia are affected by EUVD-2026-17514?

CVE-2026-24154 is a high-severity command injection vulnerability affecting NVIDIA Jetson Linux devices (Xavier, Orin, Thor series) that enables physical attackers to achieve root-level code…

How to fix or mitigate EUVD-2026-17514?

Within 24 hours: Inventory all Jetson Xavier, Orin, and Thor series devices in production and identify physical access controls. Within 7 days: Implement physical security measures restricting device access, disable boot interruption capabilities where operationally feasible, and document Jetson Linux versions in use. Within 30 days: Contact NVIDIA for patch availability timeline and plan device replacement or isolation strategy; engage with device manufacturers on compensating controls pending vendor patch release.

Nvidia EUVD-2026-17514

| CVE-2026-24154 HIGH

OS Command Injection (CWE-78)

2026-03-31 nvidia

Command Injection RCE Denial Of Service Information Disclosure Nvidia

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 31, 2026 - 17:16 euvd

EUVD-2026-17514

Analysis Generated

Mar 31, 2026 - 17:16 vuln.today

CVE Published

Mar 31, 2026 - 16:23 nvd

HIGH 7.6

DescriptionCVE.org

NVIDIA Jetson Linux has vulnerability in initrd, where an unprivileged attacker with physical access coul inject incorrect command line arguments. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, data tampering, and information disclosure.

AnalysisAI

Command injection in NVIDIA Jetson Linux initrd allows physical attackers to execute arbitrary code with elevated privileges across Jetson Xavier, Orin, and Thor series devices. An attacker with physical access can inject malicious command-line arguments during boot without authentication (CVSS:3.1/AV:P/AC:L/PR:N), leading to complete system compromise including root-level code execution, denial of service, and data exfiltration. EPSS data not available; no public exploit identified at time of analysis, though the low attack complexity (AC:L) and physical-only requirement (AV:P) suggest exploitation is straightforward for adversaries with device access.

Technical ContextAI

This vulnerability affects the initrd (initial ramdisk) component of NVIDIA Jetson Linux, a Debian-based operating system running on NVIDIA Jetson embedded AI computing platforms including Xavier, Orin, and Thor series modules. The flaw is classified as CWE-78 (OS Command Injection), indicating improper neutralization of special elements in commands passed to the operating system shell during the boot process. The initrd is responsible for early-stage boot operations before the main filesystem is mounted, making it a critical trust boundary. The vulnerability permits command-line argument manipulation at this privileged boot stage, bypassing typical runtime security controls. The CVSS vector indicates physical attack vector (AV:P) with low complexity (AC:L), no privileges required (PR:N), scope change (S:C), and high impact across confidentiality, integrity, and availability. The scope change suggests the attacker can affect resources beyond the vulnerable component's authorization scope, potentially escalating from boot-time injection to persistent system-level compromise.

RemediationAI

NVIDIA has published security bulletin 5797 addressing this vulnerability. Organizations should immediately apply the patched version of Jetson Linux available through NVIDIA's official channels-consult https://nvidia.custhelp.com/app/answers/detail/a_id/5797 for exact fixed versions and update procedures specific to Xavier, Orin, and Thor platforms. As an interim mitigation for environments where patching is delayed, implement physical security controls including tamper-evident enclosures, secure boot configurations with verified boot chains, TPM-based attestation where supported, and restricted physical access to deployed devices. For field deployments, consider hardware-based boot integrity mechanisms and monitoring for unexpected boot parameter modifications. Organizations should audit existing Jetson device deployments to identify units in physically accessible locations and prioritize remediation based on exposure risk. Supply chain security reviews should verify that devices have not been tampered with prior to deployment, particularly for newly acquired inventory.