What is the CVSS score of EUVD-2026-52800?

EUVD-2026-52800 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.3%.

Which versions of NVIDIA Dynamo are affected by EUVD-2026-52800?

NVIDIA Dynamo for Linux is vulnerable to unauthenticated remote attacks (CVE-2026-24253, CVSS 8.2) that can disrupt AI inference services or corrupt model data without requiring user interaction.

How to fix or mitigate EUVD-2026-52800?

Within 24 hours, inventory all systems running NVIDIA Dynamo for Linux and prioritize those supporting production AI workloads. Within 7 days, implement network-level access controls restricting inbound connections to affected systems, enable detailed logging and monitoring for exploitation attempts, and request a patch timeline from NVIDIA. Within 30 days, establish a vendor patch application schedule and evaluate interim compensating controls such as network segmentation or running Dynamo in isolated environments if the patch remains unavailable.

NVIDIA Dynamo EUVD-2026-52800

| CVE-2026-24253 HIGH

Out-of-bounds Write (CWE-787)

2026-08-04 nvidia

GHSA-5c7q-rvp2-6mxc

Buffer Overflow Denial Of Service Memory Corruption Nvidia Dynamo

8.2

CVSS 3.1 · Vendor: nvidia

Severity by source

Vendor (nvidia) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

vuln.today AI

8.2 HIGH

Network-reachable service with no auth requirement; DoS is primary impact (A:H); data tampering is limited (I:L); no confidentiality exposure described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (nvidia).

CVSS VectorVendor: nvidia

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 18:02 vuln.today

CVE Published

Aug 04, 2026 - 17:22 cve.org

HIGH 8.2

DescriptionCVE.org

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service and data tampering.

AnalysisAI

Out-of-bounds write in NVIDIA Dynamo for Linux enables remote unauthenticated attackers to cause denial of service or tamper with data via network-reachable attack surface, scoring CVSS 8.2 High. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no special conditions, and no user interaction are required for exploitation. No public exploit code has been identified and CISA KEV listing is absent at time of analysis, but self-disclosure by NVIDIA and a High CVSS score warrant prompt patching in AI inference infrastructure environments.

Technical ContextAI

CWE-787 (Out-of-Bounds Write) is a memory corruption class where a program writes data beyond the boundary of an allocated buffer, corrupting adjacent memory regions. NVIDIA Dynamo is a distributed AI inference framework designed for serving large language models and other AI workloads at scale on Linux-based systems. The CPE string cpe:2.3:a:nvidia:dynamo:*:*:*:*:*:*:*:* encompasses all versions of the software with no upper or lower bound, suggesting the flaw is present across the full release history. Given that Dynamo handles network-accessible inference requests, a crafted payload triggering this write primitive could corrupt heap or stack structures, leading to process crashes (DoS) or controlled corruption of data in transit or in memory (integrity tampering). Tags confirm buffer overflow and memory corruption as the operative mechanisms.

RemediationAI

The primary remediation is to review the NVIDIA Product Security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5842 for patch availability and exact fixed version numbers, as no specific patched version was included in the supplied data - the patch status is 'patch available per vendor advisory' based on NVIDIA's self-disclosure, but the precise fix version is not independently confirmed from this dataset. Until a patch is applied, operators should consider restricting network access to NVIDIA Dynamo inference endpoints to trusted internal networks or authenticated proxies, reducing the exposure window for the unauthenticated AV:N attack vector. Additionally, enabling process isolation (e.g., containerization with strict resource limits) can limit the blast radius of a successful denial-of-service trigger by preventing cascade failure across co-hosted services. Note that network restriction alone does not eliminate risk if Dynamo endpoints are exposed to internal but semi-trusted networks.