Nvidia
Monthly
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, data tampering, and information disclosure on the affected host. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H) indicates a local, low-complexity exploit path yielding full triad compromise - consistent with classic unsafe deserialization primitives that reconstruct attacker-controlled object graphs. No public exploit or CISA KEV listing has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, tamper with data, and disclose sensitive information. The vulnerability (CWE-502) exists in the Megatron Bridge component of NVIDIA's large-scale model training infrastructure, where attacker-controlled serialized input is processed without adequate validation. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-privilege access to achieve code execution, data tampering, and information disclosure on the host system. The vulnerability (CWE-502) is exploitable locally without user interaction, making it particularly relevant in multi-tenant high-performance compute environments where Megatron Bridge is used for large-scale model training pipelines. No public exploit code or active exploitation has been identified at time of analysis, but the full C/I/A impact triad elevates the urgency for affected deployments.
Local code execution in NVIDIA Megatron Bridge exploits unsafe deserialization of attacker-controlled data, allowing a low-privileged local user to achieve full process compromise with high confidentiality, integrity, and availability impact. The CVSS 7.8 (High) vector - AV:L/AC:L/PR:L/UI:N - confirms that no network exposure, user interaction, or elevated privileges are required beyond an initial local foothold. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE-capable impact class warrants prompt remediation in multi-user AI training environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes affected systems to code execution, data tampering, and information disclosure by a local low-privileged attacker. The flaw (CWE-502) allows a maliciously crafted serialized object to hijack the application's deserialization routine, granting the attacker the full CIA impact of the process context without requiring elevated privileges or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the high CIA impact and low attack complexity make this a meaningful priority for any organization running Megatron Bridge in multi-tenant or shared compute environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a low-privileged local user to achieve arbitrary code execution, data tampering, and information disclosure on the affected host. Reported directly by NVIDIA PSIRT (psirt@nvidia.com) and classified CWE-502, the flaw requires only local system access with standard user privileges, elevating insider threat and lateral-movement risk in shared AI training environments. No public exploit code or active exploitation has been confirmed at time of analysis, but the low attack complexity and full C/I/A impact make patching a real operational priority for any deployment.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, data tampering, and information disclosure on affected systems. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full CIA impact from a local, low-complexity attack requiring no user interaction, making this a meaningful privilege escalation and code execution risk in shared compute environments such as multi-tenant GPU training clusters. No public exploit code or CISA KEV listing has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local low-privileged attacker to achieve code execution, corrupt data, and exfiltrate sensitive information. The vulnerability (CWE-502) is exploitable locally with low privileges and no user interaction, yielding a CVSS 7.8 High rating with full confidentiality, integrity, and availability impact. No public exploit code has been identified at the time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes local users to code execution, data tampering, and information disclosure. An attacker with low-privileged local access can supply crafted serialized payloads to the Bridge component, which are deserialized without adequate validation. No public exploit code or active exploitation has been identified at time of analysis, but the high C/I/A impact and low-complexity exploitation path make this a meaningful risk in multi-tenant AI training environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes systems to local code execution, data tampering, and information disclosure from a low-privileged local user. The vulnerability (CWE-502) allows an attacker with local access to supply malicious serialized payloads that the bridge processes without sufficient validation. No public exploit or CISA KEV listing is identified at time of analysis, but the full-triad high-impact CVSS score (C:H/I:H/A:H) signals severe post-exploitation potential on any host running the component.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve code execution, data tampering, and information disclosure on the host system. The CVSS:3.1 vector (AV:L/PR:L) confirms this is a local-access vulnerability targeting NVIDIA's distributed large-model training infrastructure, where a compromised or malicious low-privileged user on the same host could supply a crafted serialized payload to the Bridge component. No public exploit or CISA KEV listing has been identified at time of analysis, but the full-triad impact (C:H/I:H/A:H) makes this a meaningful threat in multi-tenant AI training cluster environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve full system compromise, including arbitrary code execution, data tampering, and information disclosure. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N) confirms that exploitation requires local access with minimal privilege but no user interaction, making it a realistic threat in multi-tenant AI training environments where Megatron Bridge is used. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local low-privileged attacker to achieve arbitrary code execution, tamper with data, and disclose sensitive information on the affected host. The CVSS 7.8 score with local attack vector and low-privilege requirement indicates an authenticated local user can exploit the flaw without user interaction, fully compromising confidentiality, integrity, and availability. No public exploit or active exploitation has been identified at time of analysis, though the CIA triad is fully impacted on successful exploitation, making this a meaningful risk in shared compute environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local low-privileged attacker to achieve code execution, data tampering, and information disclosure with no user interaction required. The AV:L/PR:L CVSS vector confines the attack to actors who already hold a valid local account on the affected host, limiting but not eliminating real-world risk in shared AI infrastructure. No public exploit code has been identified, and this vulnerability has not been listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected system. The CVSS vector (AV:L/PR:L) confirms exploitation requires local access with standard user privileges, making this most relevant to shared multi-user HPC or AI/ML training cluster environments where multiple users interact with the same Megatron infrastructure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a low-privileged local attacker to achieve arbitrary code execution, data tampering, and information disclosure on affected systems. The flaw (CWE-502) requires only an authenticated local OS session - no elevated privileges or user interaction - making it exploitable by any standard user on a host running the Bridge component. Reported directly by NVIDIA PSIRT, no public exploit has been identified at the time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-level privileges to achieve code execution, data tampering, and information disclosure on the affected system. The CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector indicates exploitation requires only local, low-privileged access with no user interaction, making this a meaningful threat in multi-tenant AI training environments where shared compute access is common. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to execute arbitrary code, tamper with data, and disclose sensitive information on affected systems. The vulnerability stems from CWE-502 (Deserialization of Untrusted Data), where a crafted malicious payload supplied to the Bridge component triggers unsafe deserialization, granting the attacker full control over the vulnerable process. No public exploit or CISA KEV listing has been identified at time of analysis, but the high-impact CVSS 7.8 score reflects the severity of successful exploitation.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local low-privileged attacker to achieve code execution, tamper with data, and disclose sensitive information on the affected host. The CVSS:3.1 score of 7.8 (High) with a local attack vector reflects that exploitation requires an existing foothold on the system, but the low privilege requirement and no user interaction needed make post-access exploitation straightforward. No public exploit code or CISA KEV listing has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes systems to code execution, data tampering, and information disclosure when an attacker with local user access supplies a malicious serialized payload to the Bridge process. The local attack vector (AV:L) and low-privilege requirement (PR:L) place this vulnerability in the context of shared AI/ML training infrastructure - multi-tenant GPU clusters where lateral movement between users is the realistic threat model. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The CVSS 7.8 score (AV:L/PR:L) constrains exploitation to local contexts, but the high impact across all three CIA triad components reflects the severity of a successful exploit. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, tamper with data, and disclose sensitive information on affected systems. Rooted in CWE-502, the flaw arises when the bridge component deserializes attacker-influenced data without adequate validation - a well-understood attack class that is particularly dangerous in distributed AI training infrastructure where serialized model state or inter-process messages transit between components. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes AI training infrastructure to code execution, data tampering, and information disclosure by local low-privileged attackers. The vulnerability (CWE-502) resides in a bridge component of the Megatron-LM distributed training framework, used extensively in large-scale LLM training clusters. No public exploit code or CISA KEV listing has been identified at time of analysis; however, CVSS 7.8 (High) reflects the severity of a full triad (C:H/I:H/A:H) impact if exploitation succeeds.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker holding standard user privileges to achieve arbitrary code execution, data tampering, and information disclosure on the affected host. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the exploitation path is local and low-privilege - no network exposure or administrator rights are required, making insider threats, shared-access HPC environments, and compromised user accounts the primary risk vectors. No public exploit code or active exploitation has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The vulnerability (CWE-502) stems from the application accepting and processing serialized data without adequate validation, enabling crafted payloads to subvert normal deserialization logic. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full C:H/I:H/A:H impact triad indicates a severe outcome if exploited by a user with existing local access.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-privilege access to execute arbitrary code, tamper with data, and disclose sensitive information. The CVSS vector (AV:L/AC:L/PR:L) indicates the vulnerability is exploitable locally without elevated privileges or user interaction, making it a significant risk in multi-tenant distributed AI training environments where multiple users share infrastructure. No public exploit or KEV listing is confirmed at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The vulnerability carries a CVSS 3.1 score of 7.8 with a local attack vector, indicating that an attacker with an existing foothold on the system can escalate impact significantly. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full CIA triad impact (High/High/High) makes this a high-priority remediation target for any organization running Megatron Bridge in research or production AI training environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-privilege access to execute arbitrary code, tamper with application data, and exfiltrate sensitive information. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation is bounded to local authenticated users or processes, but the full C:H/I:H/A:H impact triad makes successful exploitation highly damaging within that local scope. No public exploit has been identified at time of analysis, and no CISA KEV listing has been observed.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The local attack vector (AV:L) and low-privilege requirement (PR:L) limit the attack surface to users or processes with existing system access, yet the full C:H/I:H/A:H impact triad makes successful exploitation highly consequential. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the NVIDIA PSIRT has published a security advisory via their product-security GitHub repository.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, data tampering, and sensitive information disclosure on the affected system. The CVSS 7.8 base score reflects a local attack vector requiring only low-privilege access with no user interaction, producing full high-impact compromise across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the severity of potential impact warrants prompt patching in AI training environments.
Unauthenticated access to the NVIDIA NemoClaw inference server on Linux exposes sensitive model inference data and enables denial of service by adjacent network attackers. The flaw stems from a missing authentication check (CWE-306) on the inference service endpoint, meaning any host on the same network segment can interact with the service without credentials. No active exploitation has been confirmed by CISA KEV and no public exploit code is known at time of analysis, but the low attack complexity and absence of authentication barriers make this straightforward to exploit for any attacker with adjacent network positioning.
Sensitive information disclosure in NVIDIA NemoClaw arises from process invocation that exposes secrets - such as API keys or authentication tokens - through visible command-line arguments or environment variables, observable by other local users via standard tools like `ps`. All versions are affected per the wildcard CPE (`cpe:2.3:a:nvidia:nemoclaw:*:*:*:*:*:*:*:*`), and exploitation requires only a low-privileged local account on the same system. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept exploit code has been identified at time of analysis.
Credential exposure in NVIDIA NemoClaw allows a local low-privileged user, upon triggering user interaction, to access insufficiently protected credential material stored or accessible within the application's runtime context. The CVSS 5.6 Medium score reflects the constrained local attack vector (AV:L), but the high confidentiality impact (C:H) indicates that successfully harvested credentials could enable meaningful lateral movement or downstream access beyond the initial system. No public exploit code has been identified and no CISA KEV listing exists at time of analysis.
OS command injection in NVIDIA OpenShell for Linux's sandbox exec handler allows a low-privileged, network-accessible attacker to inject and execute arbitrary OS commands outside the intended sandbox boundary. All versions are affected per CPE data (cpe:2.3:a:nvidia:openshell:*:*:*:*:*:*:*:*), with confirmed potential impact spanning code execution, information disclosure, and data tampering. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Improper output encoding in NVIDIA OpenShell's inference proxy on Linux allows a local low-privileged attacker to cause information disclosure and data tampering across component boundaries. The CVSS scope-change flag (S:C) indicates impact extending beyond the vulnerable component itself, suggesting the inference proxy mediates data between trust zones. No public exploit code exists and this vulnerability has not been confirmed in CISA KEV, but the scope change elevates practical risk above the 5.2 base score suggests.
Improper certificate validation in NVIDIA NemoClaw for Linux (versions up to and including 0.0.1) allows network attackers to intercept or manipulate the deployment process, potentially yielding information disclosure, data tampering, remote code execution, and privilege escalation. The flaw stems from the deployment routine failing to properly verify TLS certificates (CWE-295), enabling machine-in-the-middle attacks. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the vendor rates full technical impact.
Privilege escalation and remote code execution in NVIDIA OpenShell for Linux stem from an incomplete deny-list in its sandbox provisioning API, letting an authenticated attacker submit inputs that were meant to be blocked but were not. Because the flaw crosses the sandbox boundary (CVSS scope change), a successful exploit can yield code execution, privilege escalation, information disclosure, data tampering, and denial of service against the host. No public exploit identified at time of analysis, and the issue is not in CISA KEV.
Code injection in NVIDIA NemoClaw's migration command (Linux, versions up to 0.0.17) allows a local attacker with low-privilege access to inject and execute arbitrary code within the process context, yielding full confidentiality, integrity, and availability impact on the vulnerable system. SSVC rates technical impact as total, consistent with the CVSS 7.8 rating, though EPSS remains very low at 0.16% (5th percentile) and no active exploitation has been observed. No public exploit has been identified at time of analysis.
Untrusted code execution in NVIDIA NemoClaw for Linux (versions up to and including 0.0.21) stems from the installer executing code without verifying its integrity, letting an attacker who can supply or interpose malicious code during installation achieve arbitrary code execution, privilege escalation, data tampering, information disclosure, and denial of service. NVIDIA assigns a CVSS of 9.8 with a fully network-based, no-privilege, no-interaction vector, though the flaw is rooted in the install process. There is no public exploit identified at time of analysis, EPSS is low at 0.25% (17th percentile), and CISA SSVC records no known exploitation.
OS command injection in NVIDIA NemoClaw for Linux allows a local low-privileged attacker to execute arbitrary operating system commands through the application's status and logs plugin command interfaces. The CVSS 7.8 score reflects high impact across confidentiality, integrity, and availability with low attack complexity and no user interaction required. No public exploit identified at time of analysis, and no CISA KEV listing observed, but the fully unscopeed local impact makes this a meaningful risk on multi-tenant or shared Linux systems running NemoClaw.
OS command injection in NVIDIA NemoClaw's NIM management component on Linux enables a local authenticated attacker to execute arbitrary operating system commands with the privileges of the targeted process. All versions of NemoClaw are indicated as affected per NVD CPE data (wildcard version range). Successful exploitation can result in full code execution, persistent data tampering, sensitive information disclosure, and denial of service on the host. No public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in NVIDIA NemoClaw's command-line interface on Linux enables a local low-privileged attacker to execute arbitrary operating system commands, leading to full compromise of confidentiality, integrity, and availability. All versions of NemoClaw appear affected per the CPE wildcard (*), and the vulnerability is rooted in improper neutralization of user-supplied input passed to shell commands (CWE-78). No public exploit code and no CISA KEV listing have been identified at time of analysis, limiting current real-world risk primarily to environments with untrusted local users.
Weak authentication in NVIDIA NemoClaw for Linux (versions 0 through 0.0.4) lets remote attackers bypass the authentication enforced by its remote-access helper workflow, enabling code execution, information disclosure, and data tampering on the host. The flaw was self-reported by NVIDIA and carries a critical 9.8 CVSS rating with a fully unauthenticated network vector. No public exploit identified at time of analysis, and EPSS estimates only a 0.57% 30-day exploitation probability, so the raw severity outpaces observed real-world activity.
Unverified code download in NVIDIA NemoClaw installation scripts for Linux (versions 0.0.0 through 0.0.21) allows a network-positioned attacker to substitute malicious payloads during installation, enabling code execution, privilege escalation, information disclosure, and data tampering on the target host. The root cause is CWE-494: the installation pipeline fetches remote code without cryptographic integrity verification, leaving the download channel open to man-in-the-middle substitution or upstream server compromise. No public exploit has been identified at time of analysis; EPSS sits at 0.20% (9th percentile) and SSVC confirms Exploitation: none, placing this firmly in the theoretical high-severity category rather than an actively exploited threat.
OS command injection in NVIDIA NemoClaw's Telegram bridge component on Linux enables a local attacker with low-privileged access to execute arbitrary operating system commands. Exploitation yields full confidentiality, integrity, and availability compromise on the affected host, with potential for privilege escalation beyond the invoking user. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) and minimal privilege requirement (PR:L) lower the practical bar for exploitation once local access is obtained.
Sandbox escape in NVIDIA OpenShell for Linux lets a low-privileged actor already operating inside the sandbox break its isolation boundary, potentially achieving code execution, privilege escalation, data tampering, and information disclosure on the host. The flaw is rooted in an uncontrolled search path element (CWE-427), so a resource the sandbox loads can be redirected to attacker-supplied code. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the assigned 9.9 CVSS reflects the full compromise achievable once the sandbox boundary is breached.
Path traversal in NVIDIA OpenShell Sandbox for Linux permits low-privileged network-authenticated attackers to bypass L7 REST network policy enforcement, reaching REST endpoints that policy rules were designed to block. The Changed Scope (S:C) in the CVSS vector signals that the real impact falls on downstream services or data stores protected by the bypassed policy, yielding high confidentiality exposure (C:H) and limited integrity impact (I:L) on resources outside the sandbox trust boundary. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at time of analysis.
OS command injection in NVIDIA OpenShell across all supported platforms allows a network-accessible malicious gateway to execute arbitrary operating system commands on a victim host when a user interacts with that gateway. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects that an attacker requires no privileges on the victim system but does require the victim to interact with a malicious or attacker-controlled gateway endpoint. Successful exploitation yields full code execution, data tampering, and information disclosure - with no public exploit or CISA KEV listing identified at time of analysis.
NVIDIA Unified Fabric Manager Enterprise session management embeds a hard-coded cryptographic key (CWE-321), enabling a local attacker to extract session material and potentially escalate privileges within the InfiniBand fabric management plane. All four active UFM Enterprise release tracks - GA, LTS 2023, LTS 2024, and LTS 2025 - are confirmed affected per CPE data published by NVIDIA. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data is absent from available intelligence, limiting probabilistic exploitation forecasting.
Command injection in NVIDIA UFM Enterprise's IBDiagnet API allows an authenticated administrator with adjacency-level network access to execute arbitrary OS commands on the host system, potentially achieving full compromise. All major release trains are affected - GA, LTS 2023, LTS 2024, and LTS 2025 - as confirmed by NVIDIA's own advisory and NVD CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world opportunistic risk constrained by the high privilege and network adjacency prerequisites.
Command injection in NVIDIA UFM Enterprise's user management component enables an authenticated administrator to execute arbitrary OS-level commands by sending a crafted API request, spanning all active release tracks (GA, LTS 2023, LTS 2024, LTS 2025). Successful exploitation can yield full code execution on the UFM host, privilege escalation beyond the administrative role, and disclosure of sensitive InfiniBand fabric management data. No public exploit code or CISA KEV listing has been identified at time of analysis, and the adjacent network attack vector (AV:A) constrains the realistic attacker population to those with both admin credentials and access to the management network segment.
Code injection in NVIDIA Unified Fabric Manager Enterprise's plugin management API allows low-privileged, adjacent-network authenticated users to execute arbitrary commands on the UFM host by submitting a specially crafted API request. All current release tracks - GA, LTS 2023, LTS 2024, and LTS 2025 - are confirmed affected per vendor-supplied CPE data. Successful exploitation yields code execution, privilege escalation, and information disclosure on a platform that controls InfiniBand fabric infrastructure, amplifying downstream impact on managed HPC and AI compute clusters. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in NVIDIA UFM Enterprise's web interface authorization component allows an attacker on the adjacent network to send specially crafted HTTP requests that circumvent authentication checks, yielding code execution and privilege escalation on the UFM management host. All four active release tracks - GA, LTS 2023, LTS 2024, and LTS 2025 - are listed as affected per NVD CPE data. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
UEFI protection mechanism failure in NVIDIA DGX Spark allows a privileged local user to bypass the UEFI administrator password, undermining firmware-level access controls. The CVSS vector (AV:L/PR:H/S:C/I:H) confirms local high-privilege access is required, but a successful exploit extends beyond the OS security boundary - a scope change that elevates the real-world impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping real-world risk contained to insider-threat and physical-access scenarios.
Out-of-bounds read in the NVIDIA DGX Spark standalone Memory Management (MM) firmware enables a local high-privileged attacker to read beyond allocated buffer boundaries, leaking potentially sensitive memory contents across security boundaries (S:C/C:H per the CVSS vector). The scope change in the CVSS vector suggests that data disclosed may originate from security domains beyond the firmware itself, such as the host OS or adjacent processes. No public exploit code or active exploitation has been identified at time of analysis, and the high-privilege local access requirement substantially constrains the realistic attacker population.
NULL pointer dereference in NVIDIA DGX Spark system firmware enables a local privileged attacker to achieve code execution with scope change into other system components. All versions of the DGX Spark firmware are affected per the wildcard CPE, with potential impacts spanning code execution, privilege escalation, denial of service, information disclosure, and data tampering. No public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds write in NVIDIA DGX Spark system firmware enables a privileged local attacker to corrupt memory and achieve code execution, privilege escalation, denial of service, information disclosure, or data tampering. The CVSS scope-change indicator (S:C) is the critical risk amplifier here - successful exploitation can breach the firmware's security boundary and affect components outside it, including potentially the host OS or hypervisor layer. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Out-of-bounds write in NVIDIA DGX Spark system firmware permits a locally authenticated, highly privileged attacker to corrupt firmware memory in a way that crosses the firmware's isolation boundary into the broader system. Successful exploitation may yield arbitrary code execution, privilege escalation beyond the initial firmware context, denial of service, information disclosure, and data tampering - all stemming from a single CWE-787 write primitive. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope-changing nature of the CVSS vector (S:C) elevates the potential blast radius significantly for affected AI compute infrastructure.
Absolute path traversal in NVIDIA Triton Inference Server for Linux exposes arbitrary filesystem files to low-privileged local attackers, with the vendor flagging potential code execution as a secondary consequence. The vulnerability is classified under CWE-36 and affects all versions captured by the wildcard CPE, meaning no upper-bound patched version is confirmed from current data. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis, though the discrepancy between the RCE tag and the CVSS confidentiality-only impact metrics leaves the true blast radius unresolved.
Denial of service in NVIDIA Triton Inference Server for Linux exposes AI inference infrastructure to remote disruption through improper input validation. Unauthenticated network attackers can crash or render unresponsive the inference server by submitting malformed inputs, with CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) confirming no authentication or user interaction is required. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the low attack complexity and zero-authentication requirement make this a meaningful availability risk for any Triton deployment reachable from untrusted networks.
Unbounded resource allocation in NVIDIA Triton Inference Server for Linux allows remote, unauthenticated attackers to exhaust server-side resources and cause denial of service against all tracked versions (CPE wildcard). The CVSS 7.5 High rating reflects a fully network-accessible attack path with no privileges or user interaction required, making the exposure surface broad for any Triton deployment reachable from untrusted networks. No public exploit code has been identified at time of analysis, and exploitation has not been confirmed by CISA KEV.
Path traversal in NVIDIA Triton Inference Server for Linux (CWE-22) lets remote attackers manipulate file paths to reach locations outside intended directories, with the vendor citing denial of service as the primary outcome. NVIDIA assigned a critical 9.8 CVSS score claiming full confidentiality, integrity, and availability impact, though the published description only asserts DoS. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Absolute path traversal in NVIDIA Triton Inference Server for Linux enables remote unauthenticated attackers to read or write files outside intended directories. Exploitation may lead to arbitrary code execution and information disclosure, elevating the practical risk above what the moderate CVSS score of 6.5 might suggest given the RCE tag. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible attack vector with no authentication requirement makes this a credible threat to exposed inference server deployments.
Privilege escalation in NVIDIA NVOS network switch operating system occurs when PKA-only SSH mode is enabled, inadvertently activating a secondary authentication channel that can be exploited if the default device password has not been rotated per NVIDIA's hardening guidance. An adjacent-network attacker who discovers this condition can authenticate via the alternative path using default credentials, bypassing the intended PKA-only enforcement and gaining elevated access to the switch. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at time of analysis, but the infrastructure impact of a compromised network switch is significant.
Remote code execution is possible in NVIDIA Cumulus Linux via its LLDP daemon, exploitable by an unauthenticated attacker positioned on an adjacent network segment. Sending crafted LLDP frames triggers a classic buffer overflow (CWE-120) in the daemon, with successful exploitation yielding full code execution on the affected network device. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog, but the high-impact CVSS vector (C:H/I:H/A:H) warrants prompt remediation in network infrastructure environments.
Local privilege escalation in NVIDIA Cumulus Linux exposes network switch operating systems to full compromise by unprivileged local users. The flaw resides in the user management component, where improper privilege assignment (CWE-250) allows a low-privileged authenticated user to escalate to higher privilege levels - likely root - with low attack complexity and no user interaction required. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the CVSS 7.8 High score reflects the full triad impact once local access is obtained.
In the Linux kernel, the following vulnerability has been resolved: fbdev: nvidia: fix potential memory leak in nvidiafb_probe() In nvidiafb_probe(), the memory allocated for modelist in nvidia_set_fbinfo() is not freed in the subsequent error paths. Fix that by calling fb_destroy_modelist().
Canonical LXD's NVIDIA GPU passthrough configuration handler fails to sanitize newline characters in user-supplied `nvidia.driver.capabilities` and `nvidia.require.*` instance config values, enabling an authenticated attacker to inject arbitrary directives into the generated `lxc.conf` file. Any LXD user with instance-creation or configuration-modification privileges can exploit this to escape the container boundary and execute arbitrary commands on the host with the full privileges of the LXD daemon - effectively achieving complete host compromise. No public exploit code or CISA KEV listing exists at time of analysis, but the network-accessible, low-privilege attack path and scope-changed CVSS vector reflect an elevated real-world threat for shared or multi-tenant LXD deployments.
Deserialization of untrusted data in NVIDIA Dynamo for Linux (versions 0 through v1.1.0) exposes unauthenticated remote attackers to denial-of-service conditions and data integrity compromise. The flaw is rooted in CWE-502 - unsafe handling of externally supplied serialized objects - and carries a CVSS 8.2 score driven by a fully unauthenticated, low-complexity network attack vector. No public exploit code and no active exploitation have been identified at time of analysis, but the absence of authentication and configuration prerequisites makes the attack surface broad for any internet-accessible Dynamo deployment.
NVIDIA Dynamo for Linux versions 0 through v1.2.0 leaks sensitive information through crafted error message generation, exploitable remotely without authentication. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms low-complexity unauthenticated network access is sufficient to trigger disclosure. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, indicating this is not currently confirmed as actively exploited at scale.
Race condition during LoRA manager singleton initialization in NVIDIA Dynamo for Linux (all versions through v1.1.0) allows unauthenticated remote attackers to cause denial of service or corrupt inference data by exploiting a TOCTOU flaw in concurrent initialization paths. The CVSS vector assigns high availability impact alongside low integrity impact, reflecting that service crashes are the primary outcome while data tampering represents a secondary, harder-to-achieve consequence. No public exploit code has been identified at time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Race condition in NVIDIA Dynamo's LoRA manager singleton initialization exposes Linux-based AI inference deployments running versions up to v1.2.0 to data tampering and denial of service. The flaw, classified under CWE-362, arises during concurrent initialization of the singleton responsible for managing Low-Rank Adaptation (LoRA) adapters, allowing competing threads or network-triggered requests to corrupt shared state before synchronization is established. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the network-accessible attack vector paired with no privilege requirement makes this relevant for any internet-facing or multi-tenant Dynamo deployment.
Remote code execution, data tampering, denial of service, and information disclosure are possible through vulnerabilities in NVIDIA Dynamo for Linux examples and recipes, affecting all versions through v1.1.0. The root cause is CWE-1357 (Relies on Insufficiently Trustworthy Component), meaning the examples or recipes bundle or reference a dependency or component without adequate integrity or trust verification, enabling an attacker to exploit that trust boundary over a network. No public exploit code exists and no active exploitation has been confirmed; EPSS places probability at 0.36% (29th percentile) and SSVC confirms exploitation status as none with a non-automatable attack path, suggesting low near-term weaponization risk despite the high CVSS base score.
Server-side request forgery in NVIDIA Dynamo's Rust multimodal media fetcher (Linux, versions through v1.1.0) allows unauthenticated remote attackers to coerce the server into issuing arbitrary HTTP requests to attacker-controlled destinations. A successful exploit can expose sensitive internal network resources, cloud metadata endpoints (e.g., IMDS at 169.254.169.254), or internal API responses, resulting in high-confidence information disclosure. No public exploit code or CISA KEV listing exists at time of analysis.
Server-side request forgery via DNS rebinding in NVIDIA Dynamo's multimodal media fetcher exposes internal network resources to remote unauthenticated attackers. All Dynamo releases from version 0 through v1.1.0 on Linux are affected. A successful exploit allows an attacker to manipulate the media fetcher into issuing HTTP requests to internal services, leading to high-confidence information disclosure - including potentially cloud metadata endpoints, internal APIs, or adjacent microservices. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the CVSS 7.5 rating and unauthenticated network vector make this a meaningful risk in exposed deployments.
Server-side request forgery in NVIDIA Dynamo's multimodal media fetcher (Linux, versions through v1.1.0) allows unauthenticated remote attackers to issue arbitrary server-side HTTP requests by supplying malicious URLs as media inputs during inference. The CVSS 3.1 vector confirms network-accessible, zero-authentication exploitation with high confidentiality impact, scoring 7.5. No active exploitation or public exploit code has been identified at time of analysis, but SSRF in cloud-hosted AI inference infrastructure carries meaningful risk due to cloud metadata service exposure.
Server-side request forgery in NVIDIA Dynamo for Linux (all versions through v1.1.0) allows unauthenticated remote attackers to force the inference server to issue arbitrary HTTP requests by embedding a crafted URL inside a multimodal inference request payload. Successful exploitation exposes internal network resources reachable from the Dynamo host, producing high-severity information disclosure without requiring any credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the PR:N/AC:L attack surface on AI serving endpoints that may be network-exposed warrants prompt remediation.
Server-side request forgery in NVIDIA Dynamo for Linux (versions 0 through v1.1.0) enables unauthenticated remote attackers to cause the server to issue arbitrary backend HTTP requests. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-exploitable with no authentication or user interaction required, making this accessible to any attacker who can reach the Dynamo service. Successful exploitation leads to confidentiality impact - likely exposure of internal services, cloud instance metadata endpoints, or internal API responses - with no public exploit or CISA KEV listing identified at time of analysis.
Server-side request forgery in NVIDIA Dynamo for Linux (versions through v1.1.0) allows unauthenticated remote attackers to read arbitrary local files by embedding a crafted local path inside a multimodal inference request. The Dynamo serving layer fails to restrict the path to an allowed directory, causing the server to resolve and return content from restricted filesystem locations, leading to high-confidentiality information disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity and lack of authentication requirements make this straightforward to exploit against any exposed Dynamo endpoint.
Path traversal in NVIDIA Dynamo's image loading component on Linux enables unauthenticated remote attackers to read arbitrary files outside the intended restricted directory, resulting in high-severity information disclosure. All releases from version 0 through v1.0.0 are affected, per EUVD-2026-52804 and the NVIDIA product security advisory. No public exploit code or active exploitation has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates low-complexity, authentication-free exploitation against any network-exposed instance.
Hash collision exploitation in NVIDIA Dynamo's multimodal embedding cache on Linux allows unauthenticated remote attackers to corrupt cached inference data by submitting specially crafted images. The cache fails to incorporate image dimensions into its hash function, meaning two images with identical pixel byte sequences but different spatial dimensions resolve to the same cache key, causing the wrong embedding to be served for subsequent requests. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the CVSS score of 7.5 with no authentication requirement (PR:N) elevates its priority in deployments where the inference API is network-accessible.
Out-of-bounds write in the multimodal serving topology of NVIDIA Dynamo for Linux allows remote unauthenticated attackers to corrupt memory, with a rated 9.8 CVSS potentially enabling remote code execution, privilege escalation, data tampering, information disclosure, and denial of service. NVIDIA (the reporting vendor) rates it critical with a network-reachable, no-privilege, no-interaction vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so the score reflects potential rather than observed impact.
Out-of-bounds write in NVIDIA Dynamo for Linux enables remote unauthenticated attackers to cause denial of service or tamper with data via network-reachable attack surface, scoring CVSS 8.2 High. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no special conditions, and no user interaction are required for exploitation. No public exploit code has been identified and CISA KEV listing is absent at time of analysis, but self-disclosure by NVIDIA and a High CVSS score warrant prompt patching in AI inference infrastructure environments.
Path traversal in NVIDIA Triton Inference Server's MLflow plugin allows a low-privileged local user to read, write, or modify files outside the designated model repository by embedding traversal sequences in a model name parameter. All Linux deployments of Triton Inference Server through version 26.02 are affected. No active exploitation has been confirmed (not listed in CISA KEV), EPSS is 0.16% (6th percentile), and SSVC rates exploitation status as none - indicating this is a real but currently low-observed-risk vulnerability that warrants patching on a standard cadence rather than emergency response.
Denial of service and information disclosure in NVIDIA DCGM Exporter allows remote unauthenticated attackers to consume server resources and potentially read runtime profiling data. The vulnerability resides in the /debug/pprof endpoints, which lack resource limits, enabling concurrent profiling requests to exhaust CPU and memory. No active exploitation has been observed, but the attack vector is network-accessible without credentials, earning a CVSS 8.2 score.
OS command injection in NVIDIA NeMo for Linux allows a local authenticated attacker to execute arbitrary commands, leading to full system compromise (code execution, privilege escalation, data tampering, and information disclosure). No public exploit code or active exploitation has been identified at the time of analysis.
We need to produce a JSON object with all the specified fields. The CVE is about a Linux kernel vulnerability in PCI/IOV, specifically an out-of-bounds access in sriov_restore_vf_rebar_state() when config reads return PCI_ERROR_RESPONSE (~0). That leads to an array index out of bounds (barsz[] index 7 > 6). Fix: bail out if read returns error, and that mirrors pci_restore_rebar_state(). Affected products: Linux kernel, likely many versions. We have references to git commits that fix it. CVSS 7.0 vector: AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H. EPSS 0.21% (low). No KEV, no known POC from input (tags: Nvidia, Buffer Overflow, Linux). Patch available from vendor. CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* Now I'll construct the JSON fields. product_name: "Linux Kernel" (1-3 words, primary product). I can use "Linux kernel" (lowercase k? The input says "Linux kernel" in description, but CPE is "linux". I'll keep "Linux kernel"). summary: Original synthesis, not copy. Start with impact verb and product. Impact: out-of-bounds array access, leading to potential crash or undefined behavior, but the CVSS says C:L/I:L/A:H, so confidentiality low, integrity low, availability high. So it can cause system crash (availability impact). Summary: "UBSAN array-index-out-of-bounds in the Linux kernel's PCI/IOV subsystem leads to potential system crash when a malfunctioning PCIe device returns PCI_ERROR_RESPONSE during state restoration. Affects all Linux kernel versions that include the vulnerable code (commit 5a8f77e24a30) prior to the fix patches. No active exploitation reported, but local authenticated users with low privileges may trigger it by causing a device to fail." Wait, only local, PR:L. Not actively exploited, EPSS low. So summary: "Local denial of service in Linux kernel PCI/IOV subsystem can be triggered by a malfunctioning device returning error responses, causing an out-of-bounds array access and potentially crashing the system. Affects versions since commit 5a8f77e24a3
Memory corruption in FFmpeg 4.4 through 8.1.2 lets an attacker trigger a double-free in the NVIDIA NVDEC hardware decoder (libavcodec/nvdec.c) by getting a victim to process a crafted video file, potentially leading to code execution or crash in any NVDEC-accelerated pipeline. The flaw sits in the ff_nvdec_start_frame_sep_ref error path, which frees frame description data via nvdec_fdd_priv_free while the calling layer later frees the same object. No public exploit identified at time of analysis; a vendor upstream fix commit is available, and CVSS 4.0 is rated 8.7 (High).
Improper deserialization of untrusted data in NVIDIA Transformers4Rec (all versions per CPE wildcard) exposes systems running the library to code execution, data tampering, and information disclosure via a local attack path. The official CVSS vector assigns C:N/I:N/A:L - a score of 4.3 - which is materially inconsistent with the vendor's own description of potential remote code execution and data tampering; this discrepancy warrants independent verification with NVIDIA's product security team. No public exploit code has been identified at time of analysis, and KEV status is not confirmed.
Spurious kernel WARN() triggers in Linux kernel mm/memory.c during process teardown when NVIDIA UVM or HMM-capable GPU drivers are present alongside private file-backed mappings containing migrated anonymous folios. The unmap path incorrectly uses vma_is_anonymous() rather than folio_test_anon() to gate device-private/exclusive page handling, producing false-positive kernel warnings (not panics) during munmap or process exit in affected configurations. No public exploit has been identified at time of analysis; EPSS at 0.17% (7th percentile) reflects the narrow triggering conditions required and the non-weaponizable nature of a spurious WARN().
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, data tampering, and information disclosure on the affected host. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H) indicates a local, low-complexity exploit path yielding full triad compromise - consistent with classic unsafe deserialization primitives that reconstruct attacker-controlled object graphs. No public exploit or CISA KEV listing has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, tamper with data, and disclose sensitive information. The vulnerability (CWE-502) exists in the Megatron Bridge component of NVIDIA's large-scale model training infrastructure, where attacker-controlled serialized input is processed without adequate validation. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-privilege access to achieve code execution, data tampering, and information disclosure on the host system. The vulnerability (CWE-502) is exploitable locally without user interaction, making it particularly relevant in multi-tenant high-performance compute environments where Megatron Bridge is used for large-scale model training pipelines. No public exploit code or active exploitation has been identified at time of analysis, but the full C/I/A impact triad elevates the urgency for affected deployments.
Local code execution in NVIDIA Megatron Bridge exploits unsafe deserialization of attacker-controlled data, allowing a low-privileged local user to achieve full process compromise with high confidentiality, integrity, and availability impact. The CVSS 7.8 (High) vector - AV:L/AC:L/PR:L/UI:N - confirms that no network exposure, user interaction, or elevated privileges are required beyond an initial local foothold. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE-capable impact class warrants prompt remediation in multi-user AI training environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes affected systems to code execution, data tampering, and information disclosure by a local low-privileged attacker. The flaw (CWE-502) allows a maliciously crafted serialized object to hijack the application's deserialization routine, granting the attacker the full CIA impact of the process context without requiring elevated privileges or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the high CIA impact and low attack complexity make this a meaningful priority for any organization running Megatron Bridge in multi-tenant or shared compute environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a low-privileged local user to achieve arbitrary code execution, data tampering, and information disclosure on the affected host. Reported directly by NVIDIA PSIRT (psirt@nvidia.com) and classified CWE-502, the flaw requires only local system access with standard user privileges, elevating insider threat and lateral-movement risk in shared AI training environments. No public exploit code or active exploitation has been confirmed at time of analysis, but the low attack complexity and full C/I/A impact make patching a real operational priority for any deployment.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, data tampering, and information disclosure on affected systems. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full CIA impact from a local, low-complexity attack requiring no user interaction, making this a meaningful privilege escalation and code execution risk in shared compute environments such as multi-tenant GPU training clusters. No public exploit code or CISA KEV listing has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local low-privileged attacker to achieve code execution, corrupt data, and exfiltrate sensitive information. The vulnerability (CWE-502) is exploitable locally with low privileges and no user interaction, yielding a CVSS 7.8 High rating with full confidentiality, integrity, and availability impact. No public exploit code has been identified at the time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes local users to code execution, data tampering, and information disclosure. An attacker with low-privileged local access can supply crafted serialized payloads to the Bridge component, which are deserialized without adequate validation. No public exploit code or active exploitation has been identified at time of analysis, but the high C/I/A impact and low-complexity exploitation path make this a meaningful risk in multi-tenant AI training environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes systems to local code execution, data tampering, and information disclosure from a low-privileged local user. The vulnerability (CWE-502) allows an attacker with local access to supply malicious serialized payloads that the bridge processes without sufficient validation. No public exploit or CISA KEV listing is identified at time of analysis, but the full-triad high-impact CVSS score (C:H/I:H/A:H) signals severe post-exploitation potential on any host running the component.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve code execution, data tampering, and information disclosure on the host system. The CVSS:3.1 vector (AV:L/PR:L) confirms this is a local-access vulnerability targeting NVIDIA's distributed large-model training infrastructure, where a compromised or malicious low-privileged user on the same host could supply a crafted serialized payload to the Bridge component. No public exploit or CISA KEV listing has been identified at time of analysis, but the full-triad impact (C:H/I:H/A:H) makes this a meaningful threat in multi-tenant AI training cluster environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve full system compromise, including arbitrary code execution, data tampering, and information disclosure. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N) confirms that exploitation requires local access with minimal privilege but no user interaction, making it a realistic threat in multi-tenant AI training environments where Megatron Bridge is used. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local low-privileged attacker to achieve arbitrary code execution, tamper with data, and disclose sensitive information on the affected host. The CVSS 7.8 score with local attack vector and low-privilege requirement indicates an authenticated local user can exploit the flaw without user interaction, fully compromising confidentiality, integrity, and availability. No public exploit or active exploitation has been identified at time of analysis, though the CIA triad is fully impacted on successful exploitation, making this a meaningful risk in shared compute environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local low-privileged attacker to achieve code execution, data tampering, and information disclosure with no user interaction required. The AV:L/PR:L CVSS vector confines the attack to actors who already hold a valid local account on the affected host, limiting but not eliminating real-world risk in shared AI infrastructure. No public exploit code has been identified, and this vulnerability has not been listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected system. The CVSS vector (AV:L/PR:L) confirms exploitation requires local access with standard user privileges, making this most relevant to shared multi-user HPC or AI/ML training cluster environments where multiple users interact with the same Megatron infrastructure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a low-privileged local attacker to achieve arbitrary code execution, data tampering, and information disclosure on affected systems. The flaw (CWE-502) requires only an authenticated local OS session - no elevated privileges or user interaction - making it exploitable by any standard user on a host running the Bridge component. Reported directly by NVIDIA PSIRT, no public exploit has been identified at the time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-level privileges to achieve code execution, data tampering, and information disclosure on the affected system. The CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector indicates exploitation requires only local, low-privileged access with no user interaction, making this a meaningful threat in multi-tenant AI training environments where shared compute access is common. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to execute arbitrary code, tamper with data, and disclose sensitive information on affected systems. The vulnerability stems from CWE-502 (Deserialization of Untrusted Data), where a crafted malicious payload supplied to the Bridge component triggers unsafe deserialization, granting the attacker full control over the vulnerable process. No public exploit or CISA KEV listing has been identified at time of analysis, but the high-impact CVSS 7.8 score reflects the severity of successful exploitation.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local low-privileged attacker to achieve code execution, tamper with data, and disclose sensitive information on the affected host. The CVSS:3.1 score of 7.8 (High) with a local attack vector reflects that exploitation requires an existing foothold on the system, but the low privilege requirement and no user interaction needed make post-access exploitation straightforward. No public exploit code or CISA KEV listing has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes systems to code execution, data tampering, and information disclosure when an attacker with local user access supplies a malicious serialized payload to the Bridge process. The local attack vector (AV:L) and low-privilege requirement (PR:L) place this vulnerability in the context of shared AI/ML training infrastructure - multi-tenant GPU clusters where lateral movement between users is the realistic threat model. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The CVSS 7.8 score (AV:L/PR:L) constrains exploitation to local contexts, but the high impact across all three CIA triad components reflects the severity of a successful exploit. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, tamper with data, and disclose sensitive information on affected systems. Rooted in CWE-502, the flaw arises when the bridge component deserializes attacker-influenced data without adequate validation - a well-understood attack class that is particularly dangerous in distributed AI training infrastructure where serialized model state or inter-process messages transit between components. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes AI training infrastructure to code execution, data tampering, and information disclosure by local low-privileged attackers. The vulnerability (CWE-502) resides in a bridge component of the Megatron-LM distributed training framework, used extensively in large-scale LLM training clusters. No public exploit code or CISA KEV listing has been identified at time of analysis; however, CVSS 7.8 (High) reflects the severity of a full triad (C:H/I:H/A:H) impact if exploitation succeeds.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker holding standard user privileges to achieve arbitrary code execution, data tampering, and information disclosure on the affected host. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the exploitation path is local and low-privilege - no network exposure or administrator rights are required, making insider threats, shared-access HPC environments, and compromised user accounts the primary risk vectors. No public exploit code or active exploitation has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The vulnerability (CWE-502) stems from the application accepting and processing serialized data without adequate validation, enabling crafted payloads to subvert normal deserialization logic. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full C:H/I:H/A:H impact triad indicates a severe outcome if exploited by a user with existing local access.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-privilege access to execute arbitrary code, tamper with data, and disclose sensitive information. The CVSS vector (AV:L/AC:L/PR:L) indicates the vulnerability is exploitable locally without elevated privileges or user interaction, making it a significant risk in multi-tenant distributed AI training environments where multiple users share infrastructure. No public exploit or KEV listing is confirmed at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The vulnerability carries a CVSS 3.1 score of 7.8 with a local attack vector, indicating that an attacker with an existing foothold on the system can escalate impact significantly. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full CIA triad impact (High/High/High) makes this a high-priority remediation target for any organization running Megatron Bridge in research or production AI training environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-privilege access to execute arbitrary code, tamper with application data, and exfiltrate sensitive information. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation is bounded to local authenticated users or processes, but the full C:H/I:H/A:H impact triad makes successful exploitation highly damaging within that local scope. No public exploit has been identified at time of analysis, and no CISA KEV listing has been observed.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The local attack vector (AV:L) and low-privilege requirement (PR:L) limit the attack surface to users or processes with existing system access, yet the full C:H/I:H/A:H impact triad makes successful exploitation highly consequential. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the NVIDIA PSIRT has published a security advisory via their product-security GitHub repository.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, data tampering, and sensitive information disclosure on the affected system. The CVSS 7.8 base score reflects a local attack vector requiring only low-privilege access with no user interaction, producing full high-impact compromise across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the severity of potential impact warrants prompt patching in AI training environments.
Unauthenticated access to the NVIDIA NemoClaw inference server on Linux exposes sensitive model inference data and enables denial of service by adjacent network attackers. The flaw stems from a missing authentication check (CWE-306) on the inference service endpoint, meaning any host on the same network segment can interact with the service without credentials. No active exploitation has been confirmed by CISA KEV and no public exploit code is known at time of analysis, but the low attack complexity and absence of authentication barriers make this straightforward to exploit for any attacker with adjacent network positioning.
Sensitive information disclosure in NVIDIA NemoClaw arises from process invocation that exposes secrets - such as API keys or authentication tokens - through visible command-line arguments or environment variables, observable by other local users via standard tools like `ps`. All versions are affected per the wildcard CPE (`cpe:2.3:a:nvidia:nemoclaw:*:*:*:*:*:*:*:*`), and exploitation requires only a low-privileged local account on the same system. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept exploit code has been identified at time of analysis.
Credential exposure in NVIDIA NemoClaw allows a local low-privileged user, upon triggering user interaction, to access insufficiently protected credential material stored or accessible within the application's runtime context. The CVSS 5.6 Medium score reflects the constrained local attack vector (AV:L), but the high confidentiality impact (C:H) indicates that successfully harvested credentials could enable meaningful lateral movement or downstream access beyond the initial system. No public exploit code has been identified and no CISA KEV listing exists at time of analysis.
OS command injection in NVIDIA OpenShell for Linux's sandbox exec handler allows a low-privileged, network-accessible attacker to inject and execute arbitrary OS commands outside the intended sandbox boundary. All versions are affected per CPE data (cpe:2.3:a:nvidia:openshell:*:*:*:*:*:*:*:*), with confirmed potential impact spanning code execution, information disclosure, and data tampering. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Improper output encoding in NVIDIA OpenShell's inference proxy on Linux allows a local low-privileged attacker to cause information disclosure and data tampering across component boundaries. The CVSS scope-change flag (S:C) indicates impact extending beyond the vulnerable component itself, suggesting the inference proxy mediates data between trust zones. No public exploit code exists and this vulnerability has not been confirmed in CISA KEV, but the scope change elevates practical risk above the 5.2 base score suggests.
Improper certificate validation in NVIDIA NemoClaw for Linux (versions up to and including 0.0.1) allows network attackers to intercept or manipulate the deployment process, potentially yielding information disclosure, data tampering, remote code execution, and privilege escalation. The flaw stems from the deployment routine failing to properly verify TLS certificates (CWE-295), enabling machine-in-the-middle attacks. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the vendor rates full technical impact.
Privilege escalation and remote code execution in NVIDIA OpenShell for Linux stem from an incomplete deny-list in its sandbox provisioning API, letting an authenticated attacker submit inputs that were meant to be blocked but were not. Because the flaw crosses the sandbox boundary (CVSS scope change), a successful exploit can yield code execution, privilege escalation, information disclosure, data tampering, and denial of service against the host. No public exploit identified at time of analysis, and the issue is not in CISA KEV.
Code injection in NVIDIA NemoClaw's migration command (Linux, versions up to 0.0.17) allows a local attacker with low-privilege access to inject and execute arbitrary code within the process context, yielding full confidentiality, integrity, and availability impact on the vulnerable system. SSVC rates technical impact as total, consistent with the CVSS 7.8 rating, though EPSS remains very low at 0.16% (5th percentile) and no active exploitation has been observed. No public exploit has been identified at time of analysis.
Untrusted code execution in NVIDIA NemoClaw for Linux (versions up to and including 0.0.21) stems from the installer executing code without verifying its integrity, letting an attacker who can supply or interpose malicious code during installation achieve arbitrary code execution, privilege escalation, data tampering, information disclosure, and denial of service. NVIDIA assigns a CVSS of 9.8 with a fully network-based, no-privilege, no-interaction vector, though the flaw is rooted in the install process. There is no public exploit identified at time of analysis, EPSS is low at 0.25% (17th percentile), and CISA SSVC records no known exploitation.
OS command injection in NVIDIA NemoClaw for Linux allows a local low-privileged attacker to execute arbitrary operating system commands through the application's status and logs plugin command interfaces. The CVSS 7.8 score reflects high impact across confidentiality, integrity, and availability with low attack complexity and no user interaction required. No public exploit identified at time of analysis, and no CISA KEV listing observed, but the fully unscopeed local impact makes this a meaningful risk on multi-tenant or shared Linux systems running NemoClaw.
OS command injection in NVIDIA NemoClaw's NIM management component on Linux enables a local authenticated attacker to execute arbitrary operating system commands with the privileges of the targeted process. All versions of NemoClaw are indicated as affected per NVD CPE data (wildcard version range). Successful exploitation can result in full code execution, persistent data tampering, sensitive information disclosure, and denial of service on the host. No public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in NVIDIA NemoClaw's command-line interface on Linux enables a local low-privileged attacker to execute arbitrary operating system commands, leading to full compromise of confidentiality, integrity, and availability. All versions of NemoClaw appear affected per the CPE wildcard (*), and the vulnerability is rooted in improper neutralization of user-supplied input passed to shell commands (CWE-78). No public exploit code and no CISA KEV listing have been identified at time of analysis, limiting current real-world risk primarily to environments with untrusted local users.
Weak authentication in NVIDIA NemoClaw for Linux (versions 0 through 0.0.4) lets remote attackers bypass the authentication enforced by its remote-access helper workflow, enabling code execution, information disclosure, and data tampering on the host. The flaw was self-reported by NVIDIA and carries a critical 9.8 CVSS rating with a fully unauthenticated network vector. No public exploit identified at time of analysis, and EPSS estimates only a 0.57% 30-day exploitation probability, so the raw severity outpaces observed real-world activity.
Unverified code download in NVIDIA NemoClaw installation scripts for Linux (versions 0.0.0 through 0.0.21) allows a network-positioned attacker to substitute malicious payloads during installation, enabling code execution, privilege escalation, information disclosure, and data tampering on the target host. The root cause is CWE-494: the installation pipeline fetches remote code without cryptographic integrity verification, leaving the download channel open to man-in-the-middle substitution or upstream server compromise. No public exploit has been identified at time of analysis; EPSS sits at 0.20% (9th percentile) and SSVC confirms Exploitation: none, placing this firmly in the theoretical high-severity category rather than an actively exploited threat.
OS command injection in NVIDIA NemoClaw's Telegram bridge component on Linux enables a local attacker with low-privileged access to execute arbitrary operating system commands. Exploitation yields full confidentiality, integrity, and availability compromise on the affected host, with potential for privilege escalation beyond the invoking user. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) and minimal privilege requirement (PR:L) lower the practical bar for exploitation once local access is obtained.
Sandbox escape in NVIDIA OpenShell for Linux lets a low-privileged actor already operating inside the sandbox break its isolation boundary, potentially achieving code execution, privilege escalation, data tampering, and information disclosure on the host. The flaw is rooted in an uncontrolled search path element (CWE-427), so a resource the sandbox loads can be redirected to attacker-supplied code. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the assigned 9.9 CVSS reflects the full compromise achievable once the sandbox boundary is breached.
Path traversal in NVIDIA OpenShell Sandbox for Linux permits low-privileged network-authenticated attackers to bypass L7 REST network policy enforcement, reaching REST endpoints that policy rules were designed to block. The Changed Scope (S:C) in the CVSS vector signals that the real impact falls on downstream services or data stores protected by the bypassed policy, yielding high confidentiality exposure (C:H) and limited integrity impact (I:L) on resources outside the sandbox trust boundary. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at time of analysis.
OS command injection in NVIDIA OpenShell across all supported platforms allows a network-accessible malicious gateway to execute arbitrary operating system commands on a victim host when a user interacts with that gateway. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects that an attacker requires no privileges on the victim system but does require the victim to interact with a malicious or attacker-controlled gateway endpoint. Successful exploitation yields full code execution, data tampering, and information disclosure - with no public exploit or CISA KEV listing identified at time of analysis.
NVIDIA Unified Fabric Manager Enterprise session management embeds a hard-coded cryptographic key (CWE-321), enabling a local attacker to extract session material and potentially escalate privileges within the InfiniBand fabric management plane. All four active UFM Enterprise release tracks - GA, LTS 2023, LTS 2024, and LTS 2025 - are confirmed affected per CPE data published by NVIDIA. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data is absent from available intelligence, limiting probabilistic exploitation forecasting.
Command injection in NVIDIA UFM Enterprise's IBDiagnet API allows an authenticated administrator with adjacency-level network access to execute arbitrary OS commands on the host system, potentially achieving full compromise. All major release trains are affected - GA, LTS 2023, LTS 2024, and LTS 2025 - as confirmed by NVIDIA's own advisory and NVD CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world opportunistic risk constrained by the high privilege and network adjacency prerequisites.
Command injection in NVIDIA UFM Enterprise's user management component enables an authenticated administrator to execute arbitrary OS-level commands by sending a crafted API request, spanning all active release tracks (GA, LTS 2023, LTS 2024, LTS 2025). Successful exploitation can yield full code execution on the UFM host, privilege escalation beyond the administrative role, and disclosure of sensitive InfiniBand fabric management data. No public exploit code or CISA KEV listing has been identified at time of analysis, and the adjacent network attack vector (AV:A) constrains the realistic attacker population to those with both admin credentials and access to the management network segment.
Code injection in NVIDIA Unified Fabric Manager Enterprise's plugin management API allows low-privileged, adjacent-network authenticated users to execute arbitrary commands on the UFM host by submitting a specially crafted API request. All current release tracks - GA, LTS 2023, LTS 2024, and LTS 2025 - are confirmed affected per vendor-supplied CPE data. Successful exploitation yields code execution, privilege escalation, and information disclosure on a platform that controls InfiniBand fabric infrastructure, amplifying downstream impact on managed HPC and AI compute clusters. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in NVIDIA UFM Enterprise's web interface authorization component allows an attacker on the adjacent network to send specially crafted HTTP requests that circumvent authentication checks, yielding code execution and privilege escalation on the UFM management host. All four active release tracks - GA, LTS 2023, LTS 2024, and LTS 2025 - are listed as affected per NVD CPE data. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
UEFI protection mechanism failure in NVIDIA DGX Spark allows a privileged local user to bypass the UEFI administrator password, undermining firmware-level access controls. The CVSS vector (AV:L/PR:H/S:C/I:H) confirms local high-privilege access is required, but a successful exploit extends beyond the OS security boundary - a scope change that elevates the real-world impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping real-world risk contained to insider-threat and physical-access scenarios.
Out-of-bounds read in the NVIDIA DGX Spark standalone Memory Management (MM) firmware enables a local high-privileged attacker to read beyond allocated buffer boundaries, leaking potentially sensitive memory contents across security boundaries (S:C/C:H per the CVSS vector). The scope change in the CVSS vector suggests that data disclosed may originate from security domains beyond the firmware itself, such as the host OS or adjacent processes. No public exploit code or active exploitation has been identified at time of analysis, and the high-privilege local access requirement substantially constrains the realistic attacker population.
NULL pointer dereference in NVIDIA DGX Spark system firmware enables a local privileged attacker to achieve code execution with scope change into other system components. All versions of the DGX Spark firmware are affected per the wildcard CPE, with potential impacts spanning code execution, privilege escalation, denial of service, information disclosure, and data tampering. No public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds write in NVIDIA DGX Spark system firmware enables a privileged local attacker to corrupt memory and achieve code execution, privilege escalation, denial of service, information disclosure, or data tampering. The CVSS scope-change indicator (S:C) is the critical risk amplifier here - successful exploitation can breach the firmware's security boundary and affect components outside it, including potentially the host OS or hypervisor layer. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Out-of-bounds write in NVIDIA DGX Spark system firmware permits a locally authenticated, highly privileged attacker to corrupt firmware memory in a way that crosses the firmware's isolation boundary into the broader system. Successful exploitation may yield arbitrary code execution, privilege escalation beyond the initial firmware context, denial of service, information disclosure, and data tampering - all stemming from a single CWE-787 write primitive. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope-changing nature of the CVSS vector (S:C) elevates the potential blast radius significantly for affected AI compute infrastructure.
Absolute path traversal in NVIDIA Triton Inference Server for Linux exposes arbitrary filesystem files to low-privileged local attackers, with the vendor flagging potential code execution as a secondary consequence. The vulnerability is classified under CWE-36 and affects all versions captured by the wildcard CPE, meaning no upper-bound patched version is confirmed from current data. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis, though the discrepancy between the RCE tag and the CVSS confidentiality-only impact metrics leaves the true blast radius unresolved.
Denial of service in NVIDIA Triton Inference Server for Linux exposes AI inference infrastructure to remote disruption through improper input validation. Unauthenticated network attackers can crash or render unresponsive the inference server by submitting malformed inputs, with CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) confirming no authentication or user interaction is required. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the low attack complexity and zero-authentication requirement make this a meaningful availability risk for any Triton deployment reachable from untrusted networks.
Unbounded resource allocation in NVIDIA Triton Inference Server for Linux allows remote, unauthenticated attackers to exhaust server-side resources and cause denial of service against all tracked versions (CPE wildcard). The CVSS 7.5 High rating reflects a fully network-accessible attack path with no privileges or user interaction required, making the exposure surface broad for any Triton deployment reachable from untrusted networks. No public exploit code has been identified at time of analysis, and exploitation has not been confirmed by CISA KEV.
Path traversal in NVIDIA Triton Inference Server for Linux (CWE-22) lets remote attackers manipulate file paths to reach locations outside intended directories, with the vendor citing denial of service as the primary outcome. NVIDIA assigned a critical 9.8 CVSS score claiming full confidentiality, integrity, and availability impact, though the published description only asserts DoS. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Absolute path traversal in NVIDIA Triton Inference Server for Linux enables remote unauthenticated attackers to read or write files outside intended directories. Exploitation may lead to arbitrary code execution and information disclosure, elevating the practical risk above what the moderate CVSS score of 6.5 might suggest given the RCE tag. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible attack vector with no authentication requirement makes this a credible threat to exposed inference server deployments.
Privilege escalation in NVIDIA NVOS network switch operating system occurs when PKA-only SSH mode is enabled, inadvertently activating a secondary authentication channel that can be exploited if the default device password has not been rotated per NVIDIA's hardening guidance. An adjacent-network attacker who discovers this condition can authenticate via the alternative path using default credentials, bypassing the intended PKA-only enforcement and gaining elevated access to the switch. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at time of analysis, but the infrastructure impact of a compromised network switch is significant.
Remote code execution is possible in NVIDIA Cumulus Linux via its LLDP daemon, exploitable by an unauthenticated attacker positioned on an adjacent network segment. Sending crafted LLDP frames triggers a classic buffer overflow (CWE-120) in the daemon, with successful exploitation yielding full code execution on the affected network device. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog, but the high-impact CVSS vector (C:H/I:H/A:H) warrants prompt remediation in network infrastructure environments.
Local privilege escalation in NVIDIA Cumulus Linux exposes network switch operating systems to full compromise by unprivileged local users. The flaw resides in the user management component, where improper privilege assignment (CWE-250) allows a low-privileged authenticated user to escalate to higher privilege levels - likely root - with low attack complexity and no user interaction required. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the CVSS 7.8 High score reflects the full triad impact once local access is obtained.
In the Linux kernel, the following vulnerability has been resolved: fbdev: nvidia: fix potential memory leak in nvidiafb_probe() In nvidiafb_probe(), the memory allocated for modelist in nvidia_set_fbinfo() is not freed in the subsequent error paths. Fix that by calling fb_destroy_modelist().
Canonical LXD's NVIDIA GPU passthrough configuration handler fails to sanitize newline characters in user-supplied `nvidia.driver.capabilities` and `nvidia.require.*` instance config values, enabling an authenticated attacker to inject arbitrary directives into the generated `lxc.conf` file. Any LXD user with instance-creation or configuration-modification privileges can exploit this to escape the container boundary and execute arbitrary commands on the host with the full privileges of the LXD daemon - effectively achieving complete host compromise. No public exploit code or CISA KEV listing exists at time of analysis, but the network-accessible, low-privilege attack path and scope-changed CVSS vector reflect an elevated real-world threat for shared or multi-tenant LXD deployments.
Deserialization of untrusted data in NVIDIA Dynamo for Linux (versions 0 through v1.1.0) exposes unauthenticated remote attackers to denial-of-service conditions and data integrity compromise. The flaw is rooted in CWE-502 - unsafe handling of externally supplied serialized objects - and carries a CVSS 8.2 score driven by a fully unauthenticated, low-complexity network attack vector. No public exploit code and no active exploitation have been identified at time of analysis, but the absence of authentication and configuration prerequisites makes the attack surface broad for any internet-accessible Dynamo deployment.
NVIDIA Dynamo for Linux versions 0 through v1.2.0 leaks sensitive information through crafted error message generation, exploitable remotely without authentication. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms low-complexity unauthenticated network access is sufficient to trigger disclosure. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, indicating this is not currently confirmed as actively exploited at scale.
Race condition during LoRA manager singleton initialization in NVIDIA Dynamo for Linux (all versions through v1.1.0) allows unauthenticated remote attackers to cause denial of service or corrupt inference data by exploiting a TOCTOU flaw in concurrent initialization paths. The CVSS vector assigns high availability impact alongside low integrity impact, reflecting that service crashes are the primary outcome while data tampering represents a secondary, harder-to-achieve consequence. No public exploit code has been identified at time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Race condition in NVIDIA Dynamo's LoRA manager singleton initialization exposes Linux-based AI inference deployments running versions up to v1.2.0 to data tampering and denial of service. The flaw, classified under CWE-362, arises during concurrent initialization of the singleton responsible for managing Low-Rank Adaptation (LoRA) adapters, allowing competing threads or network-triggered requests to corrupt shared state before synchronization is established. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the network-accessible attack vector paired with no privilege requirement makes this relevant for any internet-facing or multi-tenant Dynamo deployment.
Remote code execution, data tampering, denial of service, and information disclosure are possible through vulnerabilities in NVIDIA Dynamo for Linux examples and recipes, affecting all versions through v1.1.0. The root cause is CWE-1357 (Relies on Insufficiently Trustworthy Component), meaning the examples or recipes bundle or reference a dependency or component without adequate integrity or trust verification, enabling an attacker to exploit that trust boundary over a network. No public exploit code exists and no active exploitation has been confirmed; EPSS places probability at 0.36% (29th percentile) and SSVC confirms exploitation status as none with a non-automatable attack path, suggesting low near-term weaponization risk despite the high CVSS base score.
Server-side request forgery in NVIDIA Dynamo's Rust multimodal media fetcher (Linux, versions through v1.1.0) allows unauthenticated remote attackers to coerce the server into issuing arbitrary HTTP requests to attacker-controlled destinations. A successful exploit can expose sensitive internal network resources, cloud metadata endpoints (e.g., IMDS at 169.254.169.254), or internal API responses, resulting in high-confidence information disclosure. No public exploit code or CISA KEV listing exists at time of analysis.
Server-side request forgery via DNS rebinding in NVIDIA Dynamo's multimodal media fetcher exposes internal network resources to remote unauthenticated attackers. All Dynamo releases from version 0 through v1.1.0 on Linux are affected. A successful exploit allows an attacker to manipulate the media fetcher into issuing HTTP requests to internal services, leading to high-confidence information disclosure - including potentially cloud metadata endpoints, internal APIs, or adjacent microservices. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the CVSS 7.5 rating and unauthenticated network vector make this a meaningful risk in exposed deployments.
Server-side request forgery in NVIDIA Dynamo's multimodal media fetcher (Linux, versions through v1.1.0) allows unauthenticated remote attackers to issue arbitrary server-side HTTP requests by supplying malicious URLs as media inputs during inference. The CVSS 3.1 vector confirms network-accessible, zero-authentication exploitation with high confidentiality impact, scoring 7.5. No active exploitation or public exploit code has been identified at time of analysis, but SSRF in cloud-hosted AI inference infrastructure carries meaningful risk due to cloud metadata service exposure.
Server-side request forgery in NVIDIA Dynamo for Linux (all versions through v1.1.0) allows unauthenticated remote attackers to force the inference server to issue arbitrary HTTP requests by embedding a crafted URL inside a multimodal inference request payload. Successful exploitation exposes internal network resources reachable from the Dynamo host, producing high-severity information disclosure without requiring any credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the PR:N/AC:L attack surface on AI serving endpoints that may be network-exposed warrants prompt remediation.
Server-side request forgery in NVIDIA Dynamo for Linux (versions 0 through v1.1.0) enables unauthenticated remote attackers to cause the server to issue arbitrary backend HTTP requests. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-exploitable with no authentication or user interaction required, making this accessible to any attacker who can reach the Dynamo service. Successful exploitation leads to confidentiality impact - likely exposure of internal services, cloud instance metadata endpoints, or internal API responses - with no public exploit or CISA KEV listing identified at time of analysis.
Server-side request forgery in NVIDIA Dynamo for Linux (versions through v1.1.0) allows unauthenticated remote attackers to read arbitrary local files by embedding a crafted local path inside a multimodal inference request. The Dynamo serving layer fails to restrict the path to an allowed directory, causing the server to resolve and return content from restricted filesystem locations, leading to high-confidentiality information disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity and lack of authentication requirements make this straightforward to exploit against any exposed Dynamo endpoint.
Path traversal in NVIDIA Dynamo's image loading component on Linux enables unauthenticated remote attackers to read arbitrary files outside the intended restricted directory, resulting in high-severity information disclosure. All releases from version 0 through v1.0.0 are affected, per EUVD-2026-52804 and the NVIDIA product security advisory. No public exploit code or active exploitation has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates low-complexity, authentication-free exploitation against any network-exposed instance.
Hash collision exploitation in NVIDIA Dynamo's multimodal embedding cache on Linux allows unauthenticated remote attackers to corrupt cached inference data by submitting specially crafted images. The cache fails to incorporate image dimensions into its hash function, meaning two images with identical pixel byte sequences but different spatial dimensions resolve to the same cache key, causing the wrong embedding to be served for subsequent requests. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the CVSS score of 7.5 with no authentication requirement (PR:N) elevates its priority in deployments where the inference API is network-accessible.
Out-of-bounds write in the multimodal serving topology of NVIDIA Dynamo for Linux allows remote unauthenticated attackers to corrupt memory, with a rated 9.8 CVSS potentially enabling remote code execution, privilege escalation, data tampering, information disclosure, and denial of service. NVIDIA (the reporting vendor) rates it critical with a network-reachable, no-privilege, no-interaction vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so the score reflects potential rather than observed impact.
Out-of-bounds write in NVIDIA Dynamo for Linux enables remote unauthenticated attackers to cause denial of service or tamper with data via network-reachable attack surface, scoring CVSS 8.2 High. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no special conditions, and no user interaction are required for exploitation. No public exploit code has been identified and CISA KEV listing is absent at time of analysis, but self-disclosure by NVIDIA and a High CVSS score warrant prompt patching in AI inference infrastructure environments.
Path traversal in NVIDIA Triton Inference Server's MLflow plugin allows a low-privileged local user to read, write, or modify files outside the designated model repository by embedding traversal sequences in a model name parameter. All Linux deployments of Triton Inference Server through version 26.02 are affected. No active exploitation has been confirmed (not listed in CISA KEV), EPSS is 0.16% (6th percentile), and SSVC rates exploitation status as none - indicating this is a real but currently low-observed-risk vulnerability that warrants patching on a standard cadence rather than emergency response.
Denial of service and information disclosure in NVIDIA DCGM Exporter allows remote unauthenticated attackers to consume server resources and potentially read runtime profiling data. The vulnerability resides in the /debug/pprof endpoints, which lack resource limits, enabling concurrent profiling requests to exhaust CPU and memory. No active exploitation has been observed, but the attack vector is network-accessible without credentials, earning a CVSS 8.2 score.
OS command injection in NVIDIA NeMo for Linux allows a local authenticated attacker to execute arbitrary commands, leading to full system compromise (code execution, privilege escalation, data tampering, and information disclosure). No public exploit code or active exploitation has been identified at the time of analysis.
We need to produce a JSON object with all the specified fields. The CVE is about a Linux kernel vulnerability in PCI/IOV, specifically an out-of-bounds access in sriov_restore_vf_rebar_state() when config reads return PCI_ERROR_RESPONSE (~0). That leads to an array index out of bounds (barsz[] index 7 > 6). Fix: bail out if read returns error, and that mirrors pci_restore_rebar_state(). Affected products: Linux kernel, likely many versions. We have references to git commits that fix it. CVSS 7.0 vector: AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H. EPSS 0.21% (low). No KEV, no known POC from input (tags: Nvidia, Buffer Overflow, Linux). Patch available from vendor. CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* Now I'll construct the JSON fields. product_name: "Linux Kernel" (1-3 words, primary product). I can use "Linux kernel" (lowercase k? The input says "Linux kernel" in description, but CPE is "linux". I'll keep "Linux kernel"). summary: Original synthesis, not copy. Start with impact verb and product. Impact: out-of-bounds array access, leading to potential crash or undefined behavior, but the CVSS says C:L/I:L/A:H, so confidentiality low, integrity low, availability high. So it can cause system crash (availability impact). Summary: "UBSAN array-index-out-of-bounds in the Linux kernel's PCI/IOV subsystem leads to potential system crash when a malfunctioning PCIe device returns PCI_ERROR_RESPONSE during state restoration. Affects all Linux kernel versions that include the vulnerable code (commit 5a8f77e24a30) prior to the fix patches. No active exploitation reported, but local authenticated users with low privileges may trigger it by causing a device to fail." Wait, only local, PR:L. Not actively exploited, EPSS low. So summary: "Local denial of service in Linux kernel PCI/IOV subsystem can be triggered by a malfunctioning device returning error responses, causing an out-of-bounds array access and potentially crashing the system. Affects versions since commit 5a8f77e24a3
Memory corruption in FFmpeg 4.4 through 8.1.2 lets an attacker trigger a double-free in the NVIDIA NVDEC hardware decoder (libavcodec/nvdec.c) by getting a victim to process a crafted video file, potentially leading to code execution or crash in any NVDEC-accelerated pipeline. The flaw sits in the ff_nvdec_start_frame_sep_ref error path, which frees frame description data via nvdec_fdd_priv_free while the calling layer later frees the same object. No public exploit identified at time of analysis; a vendor upstream fix commit is available, and CVSS 4.0 is rated 8.7 (High).
Improper deserialization of untrusted data in NVIDIA Transformers4Rec (all versions per CPE wildcard) exposes systems running the library to code execution, data tampering, and information disclosure via a local attack path. The official CVSS vector assigns C:N/I:N/A:L - a score of 4.3 - which is materially inconsistent with the vendor's own description of potential remote code execution and data tampering; this discrepancy warrants independent verification with NVIDIA's product security team. No public exploit code has been identified at time of analysis, and KEV status is not confirmed.
Spurious kernel WARN() triggers in Linux kernel mm/memory.c during process teardown when NVIDIA UVM or HMM-capable GPU drivers are present alongside private file-backed mappings containing migrated anonymous folios. The unmap path incorrectly uses vma_is_anonymous() rather than folio_test_anon() to gate device-private/exclusive page handling, producing false-positive kernel warnings (not panics) during munmap or process exit in affected configurations. No public exploit has been identified at time of analysis; EPSS at 0.17% (7th percentile) reflects the narrow triggering conditions required and the non-weaponizable nature of a spurious WARN().