What is the CVSS score of EUVD-2026-33985?

EUVD-2026-33985 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of NVIDIA NVTabular are affected by EUVD-2026-33985?

NVIDIA NVTabular, a machine learning library used in data science pipelines, contains a deserialization vulnerability allowing attackers with local system access to execute arbitrary code and access…

How to fix or mitigate EUVD-2026-33985?

24 hours: Identify all systems running NVTabular and restrict local access to essential personnel only; audit recent system activity logs for suspicious processes or file access. 7 days: Deploy file integrity monitoring (auditd/osquery) on affected systems; isolate ML infrastructure on dedicated network segments; enable comprehensive audit logging. 30 days: Monitor NVIDIA security advisories for patch availability; evaluate alternative tabular feature-engineering libraries or implement containerized sandboxing; develop and test incident response procedures.

NVIDIA NVTabular EUVD-2026-33985

| CVE-2026-24237 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-02 nvidia

GHSA-g694-w46x-9wjv

Nvidia RCE Deserialization Information Disclosure Nvtabular

7.8

CVSS 3.1 · Vendor: nvidia

Severity by source

Vendor (nvidia) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (nvidia) · only source for this CVE.

CVSS VectorVendor: nvidia

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 17:31 vuln.today

DescriptionCVE.org

NVIDIA NVTabular contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

AnalysisAI

Local code execution in NVIDIA NVTabular allows a low-privileged attacker to abuse insecure deserialization of untrusted data, potentially leading to arbitrary code execution, data tampering, and information disclosure on the host running the library. The flaw carries a CVSS 7.8 (High) rating with confidentiality, integrity, and availability all marked High, and currently no public exploit identified at time of analysis. NVTabular is a tabular feature-engineering library used in recommender-system pipelines, so the practical blast radius is data-science workstations and ML training nodes.

Technical ContextAI

NVTabular is NVIDIA's GPU-accelerated feature engineering and preprocessing library for tabular data, part of the Merlin recommender-systems framework, typically embedded in Python-based ML training pipelines. The root cause is classified as CWE-502 (Deserialization of Untrusted Data), which in the Python/ML ecosystem most commonly manifests through pickle-based loaders (e.g., workflow.load(), joblib, or torch.load) that execute attacker-controlled gadget chains during object reconstruction. Per the affected CPE (cpe:2.3:a:nvidia:nvtabular:*), all versions appear in scope until NVIDIA publishes a fixed build in advisory a_id/5851.

RemediationAI

Patch available per vendor advisory - upgrade NVTabular to the fixed release identified in NVIDIA security bulletin a_id 5851 at https://nvidia.custhelp.com/app/answers/detail/a_id/5851, citing the exact version listed by NVIDIA at the time of patching (no specific version was provided in the input data, so do not assume one). As a compensating control until the patch is applied, treat all NVTabular workflow files, schema artifacts, and serialized preprocessing objects as untrusted input: load them only from cryptographically verified internal sources, never directly from user uploads or model-hub downloads, and run NVTabular inference/training in a non-privileged, network-isolated container so a successful deserialization payload cannot pivot off the GPU node. Restrict filesystem write access on shared training hosts so unprivileged users cannot drop malicious .pkl artifacts into directories that production jobs read from; the trade-off is added friction for legitimate data scientists sharing workflows.