EUVD-2026-98549
GHSA-vhh2-pvvf-3xc7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-privileged local access to DALI host
-
DeliveryStage crafted malicious input file
-
ExploitVictim pipeline parses input, overflowing stack buffer
-
ExecutionCorrupt stack and hijack control flow
-
ImpactExecute code / leak data / crash service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The CVE description does not name a specific feature, protocol, or configuration flag; from the CVSS vector, exploitation requires local access (AV:L) by a low-privileged but authenticated user (PR:L) and user interaction (UI:R) - meaning a victim must actively process attacker-controlled input (a crafted data/media file) through a DALI pipeline. Limiting factors: the attacker cannot reach this over the network, must already have a local foothold with at least low privileges, and must induce or wait for a user/process to load the malicious input; exploitation is therefore constrained to multi-tenant or pipeline-automation GPU hosts where untrusted input reaches DALI. Exact affected versions are unconfirmed (wildcard CPE), so defenders should confirm whether their deployed DALI version is in-scope via the NVIDIA advisory. |
| Impact | The CVSS 3.1 base score is 7.3 (High) with vector AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, indicating a locally-exploitable stack-based buffer overflow (CWE-121) that requires an already-authenticated low-privileged user and some form of user interaction, but which yields high confidentiality, integrity, and availability impact if triggered. This is NOT a remotely-exploitable, drive-by flaw: the Local attack vector plus required user interaction materially lowers real-world urgency compared to its High rating. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of a potentially impactful memory-corruption bug (code execution possible) against a local-only, interaction-gated attack surface means this is a 'patch in normal cycle' issue rather than an emergency: the high C/I/A is real, but the preconditions (local access, low privileges, a victim processing attacker-controlled input) significantly constrain mass exploitation. No SSVC data was supplied, so automatability and exploitation-maturity cannot be scored from the input. |
| Exploit ScenarioDerived | A machine-learning engineer or batch pipeline loads an attacker-supplied data file (e.g., a crafted image, encoded media, or serialized input) into an NVIDIA DALI data-loading pipeline on a shared GPU host; the malformed input overflows a fixed-size stack buffer during parsing, corrupting the stack. Because the attacker needs only low privileges and the overflow is low-complexity to trigger (AV:L/AC:L/PR:L), a successful overwrite could redirect execution to attacker-controlled code within the context of the DALI process, or crash the pipeline for denial of service. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Stack-based buffer overflow in NVIDIA DALI lets a locally authenticated, low-privileged user who can get a crafted input file processed through a DALI pipeline corrupt memory and potentially achieve code execution, information disclosure, data tampering, or denial of service. Per the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 7.3 High), exploitation is not remotely reachable: it requires an existing local foothold with at least low privileges plus some form of user interaction, which in practice means a victim or automated process must load attacker-controlled data. There is no public exploit identified at time of analysis and the flaw has not been added to CISA KEV; the practical risk concentrates on multi-tenant or pipeline-automation GPU hosts where untrusted files are routinely fed into DALI. Exact affected versions are unconfirmed because the CPE is a wildcard, so defenders must verify their deployed DALI build against the NVIDIA advisory.
RemediationAI
No vendor-released patch with an exact fix version is identified in the supplied data, so the first step is to check NVIDIA's advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5900 (and the CVE records at https://nvd.nist.gov/vuln/detail/CVE-2026-65148 and https://www.cve.org/CVERecord?id=CVE-2026-65148) to confirm whether your deployed DALI build is in scope and to obtain the fixed release; upgrade to that build as soon as it is named rather than assuming the wildcard CPE covers everything. Until a fixed build is applied, the most effective compensating control is to stop untrusted data from reaching DALI at all: validate, re-encode and size-limit every file before it enters a pipeline, and reject malformed or oversized media headers - this is a pipeline-level gate and adds preprocessing latency, but it directly removes the attacker-controlled input the overflow depends on. Additionally, run DALI workloads as an unprivileged, non-root account in a container with a read-only root filesystem, dropped Linux capabilities, seccomp and no host mounts, so a triggered overflow cannot escalate beyond the sandbox; the trade-off is tighter operational constraints on GPU and shared-memory access. On hosts where untrusted inputs are unavoidable and cannot be sanitized, isolate the DALI processing into a dedicated, least-privileged job or node separate from sensitive data and credentials, since the assessed vector requires a local authenticated user (PR:L) and user interaction (UI:R) - reducing who can reach the pipeline and what data sits alongside it meaningfully lowers the blast radius.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NVIDIA DALI (Data Loading Library) is a GPU-accelerated library for decoding, augmenting and preprocessing data - images, video, audio and other tensor inputs - for deep learning pipelines, and it is commonly embedded in training and inference stacks where large volumes of external files are parsed by native C/C++ kernels. The root cause here is CWE-121, a stack-based buffer overflow: a fixed-size stack buffer is written past its bounds, most plausibly while parsing or decoding attacker-supplied input whose length or structure is not validated against the destination buffer. Because the corrupted region is stack memory, the impact is code execution, information disclosure, data tampering and denial of service - the three high CIA impacts reflected in the CVSS vector. The supplied CPE (cpe:2.3:a:nvidia:dali:*:*:*:*:*:*:*:*) is unversioned, so the vulnerability record does not pin down a specific release range; the CVE descends from NVIDIA's own product-security reporting channel (advisory bundle 2026/5900 on GitHub), which is the authoritative source for the precise affected and fixed builds.
Know when Dali gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
DALI processes locally-supplied input so AV:L, and a victim must run the pipeline on malicious data (UI:R); PR:L reflects a low-privileged local user, and memory corruption plausibly yields full C/I/A.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
DescriptionCVE.org
NVIDIA DALI contains a vulnerability where an attacker could cause a stack-based buffer overflow. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.
Articles & Coverage 1
Executive ViewAI
NVIDIA DALI contains a high-severity stack-based buffer overflow (CVE-2026-65148) that can be triggered by a locally authenticated, low-privileged user through a crafted input file processed in a DALI pipeline, potentially leading to code execution, data tampering, information disclosure, or denial of service. The primary organizational risk is concentrated on multi-tenant or pipeline-automation GPU hosts where untrusted files are routinely processed, as a successful exploit could compromise data integrity and availability of shared GPU resources. Leadership should prioritize verifying exposure and limiting untrusted input to DALI until a vendor patch is available.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting DALI pipelines from processing untrusted files, validating and sanitizing all input, running DALI with least privilege, sandboxing or isolating GPU hosts, and monitoring for anomalous activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
An uncontrolled out-of-bounds read in NVIDIA DALI (Data Loading Library) can be triggered when a low-privileged local us
An uncontrolled out-of-bounds write in NVIDIA DALI (the Data Loading Library used for GPU-accelerated data preprocessing
An uncontrolled out-of-bounds read in NVIDIA DALI is triggered while the library parses attacker-supplied data inside a
Arbitrary code execution in NVIDIA DALI (all versions prior to 2.0) allows local authenticated attackers with low privil
Heap-based buffer overflow in NVIDIA DALI enables local authenticated attackers to achieve code execution, data tamperin
Local code execution and data tampering in NVIDIA DALI (Data Loading Library) is possible when a low-privileged user is
Exploit-DB