NVIDIA AIStore EUVD-2026-98559

Exploitation requires the attacker to be able to submit a dSort (distributed sort) job to the AIStore cluster and supply a crafted archive (e.g., tar/zip) whose member names embed path traversal sequences that the dSort extraction component fails to sanitize. The practical prerequisite and primary limiting factor is network access to the AIStore dSort/API endpoint: although CVSS marks PR:N (no authentication), in typical deployments the dSort job-submission interface is reachable only from within a trusted ML/training cluster or private network, so internet-facing exposure is the main risk amplifier. The AC:H rating indicates that reliably crafting the malicious archive and triggering the flaw is non-trivial; no user interaction is required (UI:N).

This is a credible, elevated-priority vulnerability but not a drop-everything emergency based on current signals. The vendor-assigned CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) scores 8.1 and indicates a network-reachable, unauthenticated flaw (PR:N) with high attack complexity (AC:H) and high impact across confidentiality, integrity, and availability - consistent with a path traversal (CWE-22) that can lead to arbitrary file write and downstream code execution. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public proof-of-concept in the provided data, so this is best treated as 'no public exploit identified at time of analysis' rather than active exploitation. No SSVC decision data was supplied. The key tension to verify: PR:N implies no authentication, yet exploitation requires the ability to submit a dSort job to the AIStore cluster, which in many real deployments is restricted to internal/trusted clients on a private network - the real-world attack surface therefore depends heavily on whether the AIStore API/dSort endpoint is network-exposed to untrusted actors. The AC:H rating also signals that crafting a working exploit is non-trivial. Net: a genuine high-severity issue warranting prompt patching, especially where AIStore is reachable beyond a trusted ML cluster boundary, but the AC:H rating and absence of KEV/POC/EPSS signals argue against treating it as an imminently weaponized threat.

An attacker with network reach to an NVIDIA AIStore cluster submits a dSort job referencing a crafted archive whose member entries contain path traversal sequences (e.g., ../../). During extraction, dSort fails to constrain the output pathname, writing attacker-controlled files outside the intended directory and overwriting sensitive files or planting executable content, potentially leading to code execution, data tampering, information disclosure, or denial of service. No public proof-of-concept is identified in the provided data, and the vendor's AC:H rating indicates a non-trivial crafting effort.