EUVD-2026-98546
GHSA-8cj8-78vg-pw33
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-priv access to ML host
-
DeliverySupply crafted input file to DALI pipeline
-
ExploitUser/job processes malicious input (UI:R)
-
ExecutionTrigger out-of-bounds read in parser
-
ImpactLeak adjacent memory or crash process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker to supply a crafted/malformed input that is subsequently processed by an NVIDIA DALI data-loading pipeline; the out-of-bounds read triggers during parsing of that attacker-controlled input. Per the CVSS vector it is local (AV:L), needs low-level privileges on the host (PR:L), and critically requires user interaction (UI:R) - a user or training job must actually run DALI over the malicious sample. Limiting factors: there is no remote network vector, so the attacker must already be able to place untrusted data into the pipeline and have it processed; environments that only ingest trusted/internally-generated data are effectively not exposed. |
| Impact | This is a moderate, not top-tier, priority. The CVSS 3.1 base score of 7.3 rests on a LOCAL attack vector (AV:L) with low complexity (AC:L) but requires both low-level privileges (PR:L) and user interaction (UI:R), meaning exploitation depends on a user or process feeding attacker-controlled data into a DALI pipeline rather than a remote unauthenticated attacker reaching a network service. No EPSS score, KEV listing, or POC was provided in the input, so exploitation likelihood signals are absent - there is no public exploit identified at time of analysis and no evidence of active exploitation. A notable internal inconsistency: the CWE is CWE-125 (out-of-bounds READ) and the description explicitly limits impact to information disclosure and denial of service, yet the vendor CVSS claims I:H (high integrity impact); an out-of-bounds read does not normally corrupt data, so the integrity rating appears inflated and should be verified with NVIDIA. Overall this reads as a legitimately exploitable memory-safety bug in an ML data-loading library whose real-world risk is bounded by the need for local access and untrusted-input processing, not a drop-everything issue. |
| Exploit ScenarioDerived | An attacker crafts a malformed input file (e.g., a media or data sample) and gets it ingested by a machine-learning data pipeline that uses NVIDIA DALI for preprocessing. When a user or training job runs DALI over the malicious input, the parser reads past buffer bounds, leaking adjacent memory contents or crashing the process. No public exploit code was identified at time of analysis, and the attack requires local access plus someone invoking the pipeline on the attacker-supplied data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
An uncontrolled out-of-bounds read in NVIDIA DALI is triggered while the library parses attacker-supplied data inside a data-loading pipeline, allowing crafted input to expose process memory contents and crash the workload, which results in information disclosure and denial of service. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H) the attack is local, requires the attacker to already hold low-level privileges on the host, and critically depends on user interaction - a user or training job must actually run DALI over the malicious sample, so environments that ingest only trusted, internally generated data are effectively not exposed. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); this is a moderate, not top-tier, priority.
RemediationAI
The primary fix is to upgrade NVIDIA DALI to the release documented in the vendor advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5900; that page is the authoritative reference for the exact patched version, and the input data does not include a confirmed fix version, so the patched build number should be taken from that advisory rather than assumed (patch status is therefore best described as unconfirmed from the available data, not as 'no patch exists'). Until the upgrade is applied, the most effective compensating control is input trust boundary enforcement: only feed DALI pipelines data from trusted, internally validated sources, and route any externally sourced dataset through a schema/format validator or a hardened conversion step outside DALI (trade-off: adds preprocessing latency and can break pipelines that depend on exotic or malformed-but-tolerated formats). Additionally, run DALI loading and decoding in a dedicated least-privileged, containerized worker with a read-only filesystem and no access to production secrets or shared mounts (trade-off: sandboxing and mount restrictions may break pipelines that rely on broad filesystem or network access), and restrict who can place files into directories consumed by DALI jobs (PR:L in the vector means the attacker needs a foothold already, so tight directory permissions and job-submission controls directly reduce exposure). Where the pipeline cannot tolerate a crash, isolate DALI decoding into a separate short-lived process so an out-of-bounds read that aborts the worker does not take down long-running training jobs, and monitor for unexpected worker terminations or anomalous memory content in decoded outputs as a detection signal. Note that these are mitigating measures only - they reduce the likelihood and blast radius of the out-of-bounds read but do not eliminate the underlying CWE-125 defect, so applying the vendor fix remains the definitive remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NVIDIA DALI (the Data Loading Library) is a GPU-accelerated framework for decoding and preprocessing images, video, audio and other datasets feeding training and inference pipelines. The flaw is a classic CWE-125 out-of-bounds read: a length, offset or index derived from attacker-controlled input is used without adequate bounds validation, so the code reads past the end of an allocated buffer, leaking adjacent heap/process memory into decoded output or error paths and, in many cases, terminating the process with a segmentation fault (the availability impact). The CPE cpe:2.3:a:nvidia:dali:*:*:*:*:*:*:*:* uses a wildcard version, indicating NVIDIA has not scoped a single release line in the public CPE data and that all DALI releases at or before the vendor's fix should be considered potentially affected. Because the primitive is a read rather than a write, integrity is not assessed as impacted (I:N); the meaningful consequences are memory disclosure and worker/GPU-pipeline crashes, which in multi-tenant or shared training infrastructure can also expose data belonging to other jobs.
Know when Dali gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Local, user-triggered parsing of attacker input (AV:L/PR:L/UI:R); an out-of-bounds read yields info disclosure (C:H) and crash (A:H) but no data corruption, so I:N not I:H.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
DescriptionCVE.org
NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability might lead to information disclosure and denial of service.
Articles & Coverage 1
Executive ViewAI
NVIDIA DALI, a data loading library used in AI/ML pipelines, contains an out-of-bounds read vulnerability (CVE-2026-65147) that can expose process memory and crash workloads when processing malicious input. The attack requires local access with low-level privileges and user interaction, limiting exposure to environments that ingest untrusted data. Leadership should prioritize monitoring and input controls, as no patch is currently available.
No vendor patch available. Interim mitigations include: process only trusted data, validate and sanitize all inputs, run DALI with least privilege, isolate workloads via containers or sandboxes, and monitor for crashes or anomalous memory access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
An uncontrolled out-of-bounds read in NVIDIA DALI (Data Loading Library) can be triggered when a low-privileged local us
An uncontrolled out-of-bounds write in NVIDIA DALI (the Data Loading Library used for GPU-accelerated data preprocessing
Arbitrary code execution in NVIDIA DALI (all versions prior to 2.0) allows local authenticated attackers with low privil
Heap-based buffer overflow in NVIDIA DALI enables local authenticated attackers to achieve code execution, data tamperin
Local code execution and data tampering in NVIDIA DALI (Data Loading Library) is possible when a low-privileged user is
Stack-based buffer overflow in NVIDIA DALI lets a locally authenticated, low-privileged user who can get a crafted input
Exploit-DB