What is the CVSS score of EUVD-2026-35499?

EUVD-2026-35499 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of NVIDIA DALI are affected by EUVD-2026-35499?

A heap-based buffer overflow in NVIDIA DALI, the GPU-accelerated data loading library, allows local users with valid credentials to execute arbitrary code, tamper with training data, or disable data…

How to fix or mitigate EUVD-2026-35499?

24 hours: Identify all NVIDIA DALI deployments and document user access lists; review access logs for suspicious activity. 7 days: Implement input validation and principle-of-least-privilege controls; contact NVIDIA support for patch timeline and interim guidance. 30 days: Apply vendor-released patch immediately upon availability and validate thoroughly in staging before production deployment.

NVIDIA DALI EUVD-2026-35499

| CVE-2026-24180 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-09 nvidia

GHSA-x5qp-7hqq-hm2j

Nvidia Heap Overflow RCE Information Disclosure Buffer Overflow Denial Of Service

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 16:50 vuln.today

DescriptionCVE.org

NVIDIA DALI contains a vulnerability in a component where an attacker could cause a heap-based buffer overflow. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.

AnalysisAI

Heap-based buffer overflow in NVIDIA DALI enables local authenticated attackers to achieve code execution, data tampering, denial of service, or information disclosure when a victim user interacts with attacker-supplied input. The flaw affects the Data Loading Library used in GPU-accelerated deep learning data pipelines and carries a CVSS 3.1 score of 7.3 (High). No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

NVIDIA DALI (Data Loading Library) is a GPU-accelerated library for decoding and augmenting image, video, and audio data feeding deep learning frameworks such as PyTorch, TensorFlow, MXNet, and PaddlePaddle, identified by CPE cpe:2.3:a:nvidia:dali. The root cause is CWE-122 (Heap-based Buffer Overflow), a memory-safety class typically arising in native C/C++ parsing or decoding routines where bounds checks on attacker-controlled length or offset fields are missing or incorrect, allowing writes past the end of a heap-allocated buffer and corruption of adjacent heap metadata or object pointers. In a library that ingests media files for ML training and inference, such overflows commonly occur in format-specific decoders or batched tensor construction paths processing untrusted sample data.

RemediationAI

Patch available per vendor advisory - consult the NVIDIA security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5814 for the exact fixed DALI version and upgrade the library across all training and inference nodes (pip install --upgrade nvidia-dali-cudaXXX or the equivalent conda/container image refresh), then rebuild any container images, MLOps pipelines, or model-serving artifacts that bundle DALI. Until the patched release is rolled out, restrict DALI to trusted local users only, avoid feeding it untrusted datasets or media files from external contributors, and treat shared multi-tenant GPU notebook environments as elevated-risk; isolating training jobs in per-user containers or VMs limits the blast radius of a successful overflow at the cost of additional orchestration overhead. Reference NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-24180) and CVE.org (https://www.cve.org/CVERecord?id=CVE-2026-24180) for tracking.