Dali EUVD-2026-19753

NVIDIA DALI (Data Loading Library) is a GPU-accelerated library for data loading and preprocessing in deep learning applications. The vulnerability stems from CWE-502 (Deserialization of Untrusted Data), a dangerous pattern where the application deserializes data from untrusted sources without proper validation. When an attacker can control serialized data structures that DALI processes, they can inject malicious objects that execute arbitrary code during the deserialization process. This affects the product identified as cpe:2.3:a:nvidia:dali across all versions prior to the 2.0 release. Deserialization vulnerabilities are particularly dangerous in libraries handling data pipelines, as they may process user-supplied training data, model files, or configuration files that could contain malicious serialized payloads. The local attack vector (AV:L) indicates exploitation requires local access to the system running DALI, while the requirement for user interaction (UI:R) suggests a user must trigger the deserialization process, possibly by loading a malicious data file or configuration.