What is the CVSS score of EUVD-2026-52802?

EUVD-2026-52802 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of NVIDIA Dynamo are affected by EUVD-2026-52802?

NVIDIA Dynamo for Linux contains a critical out-of-bounds memory corruption vulnerability (CVSS 9.8, CVE-2026-24254) that allows remote unauthenticated attackers to execute code or manipulate data;…

How to fix or mitigate EUVD-2026-52802?

Within 24 hours, identify all systems running NVIDIA Dynamo on Linux and isolate them from untrusted networks; establish real-time monitoring for exploitation attempts targeting port ranges used by multimodal serving topologies. Within 7 days, implement strict network segmentation restricting Dynamo services to authenticated internal access only, disable any public-facing multimodal serving endpoints, and deploy intrusion detection signatures for CVE-2026-24254. Within 30 days, establish an upgrade path by monitoring NVIDIA security advisories for patch availability, evaluate alternative AI serving solutions with equivalent security posture, and conduct a comprehensive risk assessment to determine business continuity if Dynamo systems cannot be safely deployed.

NVIDIA Dynamo EUVD-2026-52802

| CVE-2026-24254 CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-08-04 nvidia

GHSA-4gq3-gh66-qq8g

RCE Buffer Overflow Denial Of Service Information Disclosure Nvidia Dynamo

9.8

CVSS 3.1 · Vendor: nvidia

Severity by source

Vendor (nvidia) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable serving endpoint with no auth or interaction and low complexity (AV:N/AC:L/PR:N/UI:N); out-of-bounds write enabling code execution yields full C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (nvidia).

CVSS VectorVendor: nvidia

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 18:00 vuln.today

CVE Published

Aug 04, 2026 - 17:23 cve.org

CRITICAL 9.8

DescriptionCVE.org

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.

Articles & Coverage 1

News Critical Out-of-Bounds Write in NVIDIA Dynamo for Linux - CVE-2026-24254 Aug 05, 2026

AnalysisAI

Out-of-bounds write in the multimodal serving topology of NVIDIA Dynamo for Linux allows remote unauthenticated attackers to corrupt memory, with a rated 9.8 CVSS potentially enabling remote code execution, privilege escalation, data tampering, information disclosure, and denial of service. NVIDIA (the reporting vendor) rates it critical with a network-reachable, no-privilege, no-interaction vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so the score reflects potential rather than observed impact.

Technical ContextAI

NVIDIA Dynamo is a distributed, high-throughput inference-serving framework for large-scale generative and multimodal AI models, deployed on Linux to route and orchestrate model requests across GPU worker fleets. The flaw resides specifically in its multimodal serving topology - the request-handling path that processes and dispatches mixed input types (e.g., text plus image/audio) across serving components - where insufficient bounds checking permits writing beyond an allocated buffer. An out-of-bounds write of this class typically stems from unvalidated length/index handling on attacker-controlled input, and can overwrite adjacent heap or stack data to influence control flow. Notably, the assigned CWE-288 (Authentication Bypass Using an Alternate Path or Channel) does not match the described out-of-bounds-write memory-corruption behavior, which is more consistent with CWE-787 - this mapping should be verified against the vendor advisory.

RemediationAI

No exact fix version is present in the provided data, so no vendor-released patch version can be confirmed here; consult the NVIDIA product-security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5842 for the patched release and upgrade to it as the primary remediation. Until a confirmed fixed version is applied, reduce exposure by restricting network access to Dynamo serving endpoints so they are not reachable from untrusted networks (place them behind an authenticated gateway or internal-only VLAN, accepting the trade-off of added routing/latency and broken external clients), and where operationally feasible disable or avoid the multimodal serving topology path if your deployment does not require mixed-modality inputs (trade-off: loss of multimodal functionality). Additionally, monitor Dynamo worker processes for crashes and anomalous memory behavior as a detection compensating control. Cross-reference https://nvd.nist.gov/vuln/detail/CVE-2026-24254 for updates.