Nvidia
Monthly
An authentication bypass in OpenBMC's phosphor-net-ipmid IPMI stack lets a network attacker with no credentials complete IPMI 2.0 RAKP session authentication and obtain full BMC control. A crafted RAKP Message 1 forces the handler to return before the authentication object's constructor defaults are overwritten, so the service accepts a RAKP Message 3 whose HMAC is keyed with the hard-coded 20-byte 'userKey' derived from the string '0penBmc' combined with an often-predictable 'bmcRandomNum'. The flaw affects downstream vendors that ship phosphor-net-ipmid as their IPMI implementation, including NVIDIA and H3C, and runZero published a public advisory; no CISA KEV entry or EPSS score was supplied, and no patched version was identified in the provided data.
Privilege escalation in OpenBMC's phosphor-net-ipmid IPMI stack allows an attacker who already holds a valid low-privileged IPMI session to redirect that session's authorization context to a different, higher-privileged account while the original integrity and encryption keys stay in place, so no re-authentication ever occurs. Downstream vendors that package phosphor-net-ipmid — NVIDIA and H3C among them — inherit the flaw in their BMC firmware. Rated CVSS 8.8 with high confidentiality, integrity and availability impact; no public exploit code identified at time of analysis, and the issue is not listed in CISA KEV.
Out-of-bounds read and write in the Linux kernel's forcedeth NVIDIA ethernet driver triggers on every S3 suspend/resume cycle due to an off-by-one loop terminator in nv_suspend() and nv_resume(). The loop runs one iteration past the end of the saved_config_space[] array, overwriting adjacent kernel memory (np->name_rx[]) and issuing a stray MMIO write one dword beyond the ioremap'd hardware window; with CONFIG_UBSAN_TRAP=y the kernel aborts during the suspend path. The bug has existed since Linux 2.6.27 but was only surfaced by UBSAN on Apple Macmini3,1 (MCP79) hardware during S3 cycling. No public exploit has been identified at time of analysis.
Missing authorization (CWE-862) in NVIDIA Triton Inference Server for Linux allows unauthenticated remote attackers to reach protected API endpoints without authorization checks. Per NVIDIA's own description, successful exploitation can lead to information disclosure, data tampering, and denial of service - though the vendor's CVSS vector scores only A:H (Availability: High), creating a notable discrepancy with the stated impact breadth. No public exploit code or CISA KEV listing exists at time of analysis.
Denial of service in NVIDIA Triton Inference Server for Linux allows unauthenticated remote attackers to exhaust server resources via a crafted request that triggers excessive iteration. All tracked versions under the wildcard CPE are potentially affected, and the vulnerability is network-reachable with no authentication or user interaction required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, data tampering, and information disclosure on the affected host. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H) indicates a local, low-complexity exploit path yielding full triad compromise - consistent with classic unsafe deserialization primitives that reconstruct attacker-controlled object graphs. No public exploit or CISA KEV listing has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, tamper with data, and disclose sensitive information. The vulnerability (CWE-502) exists in the Megatron Bridge component of NVIDIA's large-scale model training infrastructure, where attacker-controlled serialized input is processed without adequate validation. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-privilege access to achieve code execution, data tampering, and information disclosure on the host system. The vulnerability (CWE-502) is exploitable locally without user interaction, making it particularly relevant in multi-tenant high-performance compute environments where Megatron Bridge is used for large-scale model training pipelines. No public exploit code or active exploitation has been identified at time of analysis, but the full C/I/A impact triad elevates the urgency for affected deployments.
Local code execution in NVIDIA Megatron Bridge exploits unsafe deserialization of attacker-controlled data, allowing a low-privileged local user to achieve full process compromise with high confidentiality, integrity, and availability impact. The CVSS 7.8 (High) vector - AV:L/AC:L/PR:L/UI:N - confirms that no network exposure, user interaction, or elevated privileges are required beyond an initial local foothold. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE-capable impact class warrants prompt remediation in multi-user AI training environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes affected systems to code execution, data tampering, and information disclosure by a local low-privileged attacker. The flaw (CWE-502) allows a maliciously crafted serialized object to hijack the application's deserialization routine, granting the attacker the full CIA impact of the process context without requiring elevated privileges or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the high CIA impact and low attack complexity make this a meaningful priority for any organization running Megatron Bridge in multi-tenant or shared compute environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a low-privileged local user to achieve arbitrary code execution, data tampering, and information disclosure on the affected host. Reported directly by NVIDIA PSIRT (psirt@nvidia.com) and classified CWE-502, the flaw requires only local system access with standard user privileges, elevating insider threat and lateral-movement risk in shared AI training environments. No public exploit code or active exploitation has been confirmed at time of analysis, but the low attack complexity and full C/I/A impact make patching a real operational priority for any deployment.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, data tampering, and information disclosure on affected systems. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full CIA impact from a local, low-complexity attack requiring no user interaction, making this a meaningful privilege escalation and code execution risk in shared compute environments such as multi-tenant GPU training clusters. No public exploit code or CISA KEV listing has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local low-privileged attacker to achieve code execution, corrupt data, and exfiltrate sensitive information. The vulnerability (CWE-502) is exploitable locally with low privileges and no user interaction, yielding a CVSS 7.8 High rating with full confidentiality, integrity, and availability impact. No public exploit code has been identified at the time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes local users to code execution, data tampering, and information disclosure. An attacker with low-privileged local access can supply crafted serialized payloads to the Bridge component, which are deserialized without adequate validation. No public exploit code or active exploitation has been identified at time of analysis, but the high C/I/A impact and low-complexity exploitation path make this a meaningful risk in multi-tenant AI training environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes systems to local code execution, data tampering, and information disclosure from a low-privileged local user. The vulnerability (CWE-502) allows an attacker with local access to supply malicious serialized payloads that the bridge processes without sufficient validation. No public exploit or CISA KEV listing is identified at time of analysis, but the full-triad high-impact CVSS score (C:H/I:H/A:H) signals severe post-exploitation potential on any host running the component.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve code execution, data tampering, and information disclosure on the host system. The CVSS:3.1 vector (AV:L/PR:L) confirms this is a local-access vulnerability targeting NVIDIA's distributed large-model training infrastructure, where a compromised or malicious low-privileged user on the same host could supply a crafted serialized payload to the Bridge component. No public exploit or CISA KEV listing has been identified at time of analysis, but the full-triad impact (C:H/I:H/A:H) makes this a meaningful threat in multi-tenant AI training cluster environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve full system compromise, including arbitrary code execution, data tampering, and information disclosure. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N) confirms that exploitation requires local access with minimal privilege but no user interaction, making it a realistic threat in multi-tenant AI training environments where Megatron Bridge is used. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local low-privileged attacker to achieve arbitrary code execution, tamper with data, and disclose sensitive information on the affected host. The CVSS 7.8 score with local attack vector and low-privilege requirement indicates an authenticated local user can exploit the flaw without user interaction, fully compromising confidentiality, integrity, and availability. No public exploit or active exploitation has been identified at time of analysis, though the CIA triad is fully impacted on successful exploitation, making this a meaningful risk in shared compute environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local low-privileged attacker to achieve code execution, data tampering, and information disclosure with no user interaction required. The AV:L/PR:L CVSS vector confines the attack to actors who already hold a valid local account on the affected host, limiting but not eliminating real-world risk in shared AI infrastructure. No public exploit code has been identified, and this vulnerability has not been listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected system. The CVSS vector (AV:L/PR:L) confirms exploitation requires local access with standard user privileges, making this most relevant to shared multi-user HPC or AI/ML training cluster environments where multiple users interact with the same Megatron infrastructure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a low-privileged local attacker to achieve arbitrary code execution, data tampering, and information disclosure on affected systems. The flaw (CWE-502) requires only an authenticated local OS session - no elevated privileges or user interaction - making it exploitable by any standard user on a host running the Bridge component. Reported directly by NVIDIA PSIRT, no public exploit has been identified at the time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-level privileges to achieve code execution, data tampering, and information disclosure on the affected system. The CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector indicates exploitation requires only local, low-privileged access with no user interaction, making this a meaningful threat in multi-tenant AI training environments where shared compute access is common. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to execute arbitrary code, tamper with data, and disclose sensitive information on affected systems. The vulnerability stems from CWE-502 (Deserialization of Untrusted Data), where a crafted malicious payload supplied to the Bridge component triggers unsafe deserialization, granting the attacker full control over the vulnerable process. No public exploit or CISA KEV listing has been identified at time of analysis, but the high-impact CVSS 7.8 score reflects the severity of successful exploitation.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local low-privileged attacker to achieve code execution, tamper with data, and disclose sensitive information on the affected host. The CVSS:3.1 score of 7.8 (High) with a local attack vector reflects that exploitation requires an existing foothold on the system, but the low privilege requirement and no user interaction needed make post-access exploitation straightforward. No public exploit code or CISA KEV listing has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes systems to code execution, data tampering, and information disclosure when an attacker with local user access supplies a malicious serialized payload to the Bridge process. The local attack vector (AV:L) and low-privilege requirement (PR:L) place this vulnerability in the context of shared AI/ML training infrastructure - multi-tenant GPU clusters where lateral movement between users is the realistic threat model. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The CVSS 7.8 score (AV:L/PR:L) constrains exploitation to local contexts, but the high impact across all three CIA triad components reflects the severity of a successful exploit. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, tamper with data, and disclose sensitive information on affected systems. Rooted in CWE-502, the flaw arises when the bridge component deserializes attacker-influenced data without adequate validation - a well-understood attack class that is particularly dangerous in distributed AI training infrastructure where serialized model state or inter-process messages transit between components. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes AI training infrastructure to code execution, data tampering, and information disclosure by local low-privileged attackers. The vulnerability (CWE-502) resides in a bridge component of the Megatron-LM distributed training framework, used extensively in large-scale LLM training clusters. No public exploit code or CISA KEV listing has been identified at time of analysis; however, CVSS 7.8 (High) reflects the severity of a full triad (C:H/I:H/A:H) impact if exploitation succeeds.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker holding standard user privileges to achieve arbitrary code execution, data tampering, and information disclosure on the affected host. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the exploitation path is local and low-privilege - no network exposure or administrator rights are required, making insider threats, shared-access HPC environments, and compromised user accounts the primary risk vectors. No public exploit code or active exploitation has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The vulnerability (CWE-502) stems from the application accepting and processing serialized data without adequate validation, enabling crafted payloads to subvert normal deserialization logic. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full C:H/I:H/A:H impact triad indicates a severe outcome if exploited by a user with existing local access.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-privilege access to execute arbitrary code, tamper with data, and disclose sensitive information. The CVSS vector (AV:L/AC:L/PR:L) indicates the vulnerability is exploitable locally without elevated privileges or user interaction, making it a significant risk in multi-tenant distributed AI training environments where multiple users share infrastructure. No public exploit or KEV listing is confirmed at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The vulnerability carries a CVSS 3.1 score of 7.8 with a local attack vector, indicating that an attacker with an existing foothold on the system can escalate impact significantly. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full CIA triad impact (High/High/High) makes this a high-priority remediation target for any organization running Megatron Bridge in research or production AI training environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-privilege access to execute arbitrary code, tamper with application data, and exfiltrate sensitive information. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation is bounded to local authenticated users or processes, but the full C:H/I:H/A:H impact triad makes successful exploitation highly damaging within that local scope. No public exploit has been identified at time of analysis, and no CISA KEV listing has been observed.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The local attack vector (AV:L) and low-privilege requirement (PR:L) limit the attack surface to users or processes with existing system access, yet the full C:H/I:H/A:H impact triad makes successful exploitation highly consequential. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the NVIDIA PSIRT has published a security advisory via their product-security GitHub repository.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, data tampering, and sensitive information disclosure on the affected system. The CVSS 7.8 base score reflects a local attack vector requiring only low-privilege access with no user interaction, producing full high-impact compromise across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the severity of potential impact warrants prompt patching in AI training environments.
Unauthenticated access to the NVIDIA NemoClaw inference server on Linux exposes sensitive model inference data and enables denial of service by adjacent network attackers. The flaw stems from a missing authentication check (CWE-306) on the inference service endpoint, meaning any host on the same network segment can interact with the service without credentials. No active exploitation has been confirmed by CISA KEV and no public exploit code is known at time of analysis, but the low attack complexity and absence of authentication barriers make this straightforward to exploit for any attacker with adjacent network positioning.
Improper certificate validation in NVIDIA NemoClaw for Linux (versions up to and including 0.0.1) allows network attackers to intercept or manipulate the deployment process, potentially yielding information disclosure, data tampering, remote code execution, and privilege escalation. The flaw stems from the deployment routine failing to properly verify TLS certificates (CWE-295), enabling machine-in-the-middle attacks. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the vendor rates full technical impact.
Privilege escalation and remote code execution in NVIDIA OpenShell for Linux stem from an incomplete deny-list in its sandbox provisioning API, letting an authenticated attacker submit inputs that were meant to be blocked but were not. Because the flaw crosses the sandbox boundary (CVSS scope change), a successful exploit can yield code execution, privilege escalation, information disclosure, data tampering, and denial of service against the host. No public exploit identified at time of analysis, and the issue is not in CISA KEV.
Code injection in NVIDIA NemoClaw's migration command (Linux, versions up to 0.0.17) allows a local attacker with low-privilege access to inject and execute arbitrary code within the process context, yielding full confidentiality, integrity, and availability impact on the vulnerable system. SSVC rates technical impact as total, consistent with the CVSS 7.8 rating, though EPSS remains very low at 0.16% (5th percentile) and no active exploitation has been observed. No public exploit has been identified at time of analysis.
Untrusted code execution in NVIDIA NemoClaw for Linux (versions up to and including 0.0.21) stems from the installer executing code without verifying its integrity, letting an attacker who can supply or interpose malicious code during installation achieve arbitrary code execution, privilege escalation, data tampering, information disclosure, and denial of service. NVIDIA assigns a CVSS of 9.8 with a fully network-based, no-privilege, no-interaction vector, though the flaw is rooted in the install process. There is no public exploit identified at time of analysis, EPSS is low at 0.25% (17th percentile), and CISA SSVC records no known exploitation.
OS command injection in NVIDIA NemoClaw for Linux allows a local low-privileged attacker to execute arbitrary operating system commands through the application's status and logs plugin command interfaces. The CVSS 7.8 score reflects high impact across confidentiality, integrity, and availability with low attack complexity and no user interaction required. No public exploit identified at time of analysis, and no CISA KEV listing observed, but the fully unscopeed local impact makes this a meaningful risk on multi-tenant or shared Linux systems running NemoClaw.
OS command injection in NVIDIA NemoClaw's NIM management component on Linux enables a local authenticated attacker to execute arbitrary operating system commands with the privileges of the targeted process. All versions of NemoClaw are indicated as affected per NVD CPE data (wildcard version range). Successful exploitation can result in full code execution, persistent data tampering, sensitive information disclosure, and denial of service on the host. No public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in NVIDIA NemoClaw's command-line interface on Linux enables a local low-privileged attacker to execute arbitrary operating system commands, leading to full compromise of confidentiality, integrity, and availability. All versions of NemoClaw appear affected per the CPE wildcard (*), and the vulnerability is rooted in improper neutralization of user-supplied input passed to shell commands (CWE-78). No public exploit code and no CISA KEV listing have been identified at time of analysis, limiting current real-world risk primarily to environments with untrusted local users.
Weak authentication in NVIDIA NemoClaw for Linux (versions 0 through 0.0.4) lets remote attackers bypass the authentication enforced by its remote-access helper workflow, enabling code execution, information disclosure, and data tampering on the host. The flaw was self-reported by NVIDIA and carries a critical 9.8 CVSS rating with a fully unauthenticated network vector. No public exploit identified at time of analysis, and EPSS estimates only a 0.57% 30-day exploitation probability, so the raw severity outpaces observed real-world activity.
Unverified code download in NVIDIA NemoClaw installation scripts for Linux (versions 0.0.0 through 0.0.21) allows a network-positioned attacker to substitute malicious payloads during installation, enabling code execution, privilege escalation, information disclosure, and data tampering on the target host. The root cause is CWE-494: the installation pipeline fetches remote code without cryptographic integrity verification, leaving the download channel open to man-in-the-middle substitution or upstream server compromise. No public exploit has been identified at time of analysis; EPSS sits at 0.20% (9th percentile) and SSVC confirms Exploitation: none, placing this firmly in the theoretical high-severity category rather than an actively exploited threat.
OS command injection in NVIDIA NemoClaw's Telegram bridge component on Linux enables a local attacker with low-privileged access to execute arbitrary operating system commands. Exploitation yields full confidentiality, integrity, and availability compromise on the affected host, with potential for privilege escalation beyond the invoking user. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) and minimal privilege requirement (PR:L) lower the practical bar for exploitation once local access is obtained.
Sandbox escape in NVIDIA OpenShell for Linux lets a low-privileged actor already operating inside the sandbox break its isolation boundary, potentially achieving code execution, privilege escalation, data tampering, and information disclosure on the host. The flaw is rooted in an uncontrolled search path element (CWE-427), so a resource the sandbox loads can be redirected to attacker-supplied code. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the assigned 9.9 CVSS reflects the full compromise achievable once the sandbox boundary is breached.
Path traversal in NVIDIA OpenShell Sandbox for Linux permits low-privileged network-authenticated attackers to bypass L7 REST network policy enforcement, reaching REST endpoints that policy rules were designed to block. The Changed Scope (S:C) in the CVSS vector signals that the real impact falls on downstream services or data stores protected by the bypassed policy, yielding high confidentiality exposure (C:H) and limited integrity impact (I:L) on resources outside the sandbox trust boundary. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at time of analysis.
OS command injection in NVIDIA OpenShell across all supported platforms allows a network-accessible malicious gateway to execute arbitrary operating system commands on a victim host when a user interacts with that gateway. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects that an attacker requires no privileges on the victim system but does require the victim to interact with a malicious or attacker-controlled gateway endpoint. Successful exploitation yields full code execution, data tampering, and information disclosure - with no public exploit or CISA KEV listing identified at time of analysis.
Code injection in NVIDIA Unified Fabric Manager Enterprise's plugin management API allows low-privileged, adjacent-network authenticated users to execute arbitrary commands on the UFM host by submitting a specially crafted API request. All current release tracks - GA, LTS 2023, LTS 2024, and LTS 2025 - are confirmed affected per vendor-supplied CPE data. Successful exploitation yields code execution, privilege escalation, and information disclosure on a platform that controls InfiniBand fabric infrastructure, amplifying downstream impact on managed HPC and AI compute clusters. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in NVIDIA UFM Enterprise's web interface authorization component allows an attacker on the adjacent network to send specially crafted HTTP requests that circumvent authentication checks, yielding code execution and privilege escalation on the UFM management host. All four active release tracks - GA, LTS 2023, LTS 2024, and LTS 2025 - are listed as affected per NVD CPE data. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
NULL pointer dereference in NVIDIA DGX Spark system firmware enables a local privileged attacker to achieve code execution with scope change into other system components. All versions of the DGX Spark firmware are affected per the wildcard CPE, with potential impacts spanning code execution, privilege escalation, denial of service, information disclosure, and data tampering. No public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds write in NVIDIA DGX Spark system firmware enables a privileged local attacker to corrupt memory and achieve code execution, privilege escalation, denial of service, information disclosure, or data tampering. The CVSS scope-change indicator (S:C) is the critical risk amplifier here - successful exploitation can breach the firmware's security boundary and affect components outside it, including potentially the host OS or hypervisor layer. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Out-of-bounds write in NVIDIA DGX Spark system firmware permits a locally authenticated, highly privileged attacker to corrupt firmware memory in a way that crosses the firmware's isolation boundary into the broader system. Successful exploitation may yield arbitrary code execution, privilege escalation beyond the initial firmware context, denial of service, information disclosure, and data tampering - all stemming from a single CWE-787 write primitive. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope-changing nature of the CVSS vector (S:C) elevates the potential blast radius significantly for affected AI compute infrastructure.
Denial of service in NVIDIA Triton Inference Server for Linux exposes AI inference infrastructure to remote disruption through improper input validation. Unauthenticated network attackers can crash or render unresponsive the inference server by submitting malformed inputs, with CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) confirming no authentication or user interaction is required. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the low attack complexity and zero-authentication requirement make this a meaningful availability risk for any Triton deployment reachable from untrusted networks.
Unbounded resource allocation in NVIDIA Triton Inference Server for Linux allows remote, unauthenticated attackers to exhaust server-side resources and cause denial of service against all tracked versions (CPE wildcard). The CVSS 7.5 High rating reflects a fully network-accessible attack path with no privileges or user interaction required, making the exposure surface broad for any Triton deployment reachable from untrusted networks. No public exploit code has been identified at time of analysis, and exploitation has not been confirmed by CISA KEV.
Path traversal in NVIDIA Triton Inference Server for Linux (CWE-22) lets remote attackers manipulate file paths to reach locations outside intended directories, with the vendor citing denial of service as the primary outcome. NVIDIA assigned a critical 9.8 CVSS score claiming full confidentiality, integrity, and availability impact, though the published description only asserts DoS. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Absolute path traversal in NVIDIA Triton Inference Server for Linux (versions 0.0 through 26.05) lets remote unauthenticated attackers reference filesystem paths outside intended directories, per NVIDIA's own advisory. NVIDIA states a successful exploit may lead to information disclosure and potentially code execution. No public exploit has been identified at time of analysis, and EPSS is low at 0.41% (34th percentile).
Privilege escalation in NVIDIA NVOS network switch operating system occurs when PKA-only SSH mode is enabled, inadvertently activating a secondary authentication channel that can be exploited if the default device password has not been rotated per NVIDIA's hardening guidance. An adjacent-network attacker who discovers this condition can authenticate via the alternative path using default credentials, bypassing the intended PKA-only enforcement and gaining elevated access to the switch. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at time of analysis, but the infrastructure impact of a compromised network switch is significant.
Buffer overflow in the LLDP daemon of NVIDIA Cumulus Linux enables an unauthenticated attacker with Layer 2 network adjacency to achieve code execution by sending specially crafted LLDP frames. Both the GA track (all versions through 5.16) and LTS track (through 5.11.5 and 5.9.5 respectively) are confirmed affected. No active exploitation or public proof-of-concept code has been identified at time of analysis, though CISA SSVC rates the technical impact as total given that a successful exploit yields full switch compromise.
Local privilege escalation in NVIDIA Cumulus Linux exposes network switch operating systems to full compromise by unprivileged local users. The flaw resides in the user management component, where improper privilege assignment (CWE-250) allows a low-privileged authenticated user to escalate to higher privilege levels - likely root - with low attack complexity and no user interaction required. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the CVSS 7.8 High score reflects the full triad impact once local access is obtained.
Canonical LXD's NVIDIA GPU passthrough configuration handler fails to sanitize newline characters in user-supplied `nvidia.driver.capabilities` and `nvidia.require.*` instance config values, enabling an authenticated attacker to inject arbitrary directives into the generated `lxc.conf` file. Any LXD user with instance-creation or configuration-modification privileges can exploit this to escape the container boundary and execute arbitrary commands on the host with the full privileges of the LXD daemon - effectively achieving complete host compromise. No public exploit code or CISA KEV listing exists at time of analysis, but the network-accessible, low-privilege attack path and scope-changed CVSS vector reflect an elevated real-world threat for shared or multi-tenant LXD deployments.
Deserialization of untrusted data in NVIDIA Dynamo for Linux (versions 0 through v1.1.0) exposes unauthenticated remote attackers to denial-of-service conditions and data integrity compromise. The flaw is rooted in CWE-502 - unsafe handling of externally supplied serialized objects - and carries a CVSS 8.2 score driven by a fully unauthenticated, low-complexity network attack vector. No public exploit code and no active exploitation have been identified at time of analysis, but the absence of authentication and configuration prerequisites makes the attack surface broad for any internet-accessible Dynamo deployment.
Remote code execution, data tampering, denial of service, and information disclosure are possible through vulnerabilities in NVIDIA Dynamo for Linux examples and recipes, affecting all versions through v1.1.0. The root cause is CWE-1357 (Relies on Insufficiently Trustworthy Component), meaning the examples or recipes bundle or reference a dependency or component without adequate integrity or trust verification, enabling an attacker to exploit that trust boundary over a network. No public exploit code exists and no active exploitation has been confirmed; EPSS places probability at 0.36% (29th percentile) and SSVC confirms exploitation status as none with a non-automatable attack path, suggesting low near-term weaponization risk despite the high CVSS base score.
Server-side request forgery in NVIDIA Dynamo's Rust multimodal media fetcher (Linux, versions through v1.1.0) allows unauthenticated remote attackers to coerce the server into issuing arbitrary HTTP requests to attacker-controlled destinations. A successful exploit can expose sensitive internal network resources, cloud metadata endpoints (e.g., IMDS at 169.254.169.254), or internal API responses, resulting in high-confidence information disclosure. No public exploit code or CISA KEV listing exists at time of analysis.
Server-side request forgery via DNS rebinding in NVIDIA Dynamo's multimodal media fetcher exposes internal network resources to remote unauthenticated attackers. All Dynamo releases from version 0 through v1.1.0 on Linux are affected. A successful exploit allows an attacker to manipulate the media fetcher into issuing HTTP requests to internal services, leading to high-confidence information disclosure - including potentially cloud metadata endpoints, internal APIs, or adjacent microservices. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the CVSS 7.5 rating and unauthenticated network vector make this a meaningful risk in exposed deployments.
Server-side request forgery in NVIDIA Dynamo's multimodal media fetcher (Linux, versions through v1.1.0) allows unauthenticated remote attackers to issue arbitrary server-side HTTP requests by supplying malicious URLs as media inputs during inference. The CVSS 3.1 vector confirms network-accessible, zero-authentication exploitation with high confidentiality impact, scoring 7.5. No active exploitation or public exploit code has been identified at time of analysis, but SSRF in cloud-hosted AI inference infrastructure carries meaningful risk due to cloud metadata service exposure.
Server-side request forgery in NVIDIA Dynamo for Linux (all versions through v1.1.0) allows unauthenticated remote attackers to force the inference server to issue arbitrary HTTP requests by embedding a crafted URL inside a multimodal inference request payload. Successful exploitation exposes internal network resources reachable from the Dynamo host, producing high-severity information disclosure without requiring any credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the PR:N/AC:L attack surface on AI serving endpoints that may be network-exposed warrants prompt remediation.
Server-side request forgery in NVIDIA Dynamo for Linux (versions 0 through v1.1.0) enables unauthenticated remote attackers to cause the server to issue arbitrary backend HTTP requests. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-exploitable with no authentication or user interaction required, making this accessible to any attacker who can reach the Dynamo service. Successful exploitation leads to confidentiality impact - likely exposure of internal services, cloud instance metadata endpoints, or internal API responses - with no public exploit or CISA KEV listing identified at time of analysis.
Server-side request forgery in NVIDIA Dynamo for Linux (versions through v1.1.0) allows unauthenticated remote attackers to read arbitrary local files by embedding a crafted local path inside a multimodal inference request. The Dynamo serving layer fails to restrict the path to an allowed directory, causing the server to resolve and return content from restricted filesystem locations, leading to high-confidentiality information disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity and lack of authentication requirements make this straightforward to exploit against any exposed Dynamo endpoint.
Path traversal in NVIDIA Dynamo's image loading component on Linux enables unauthenticated remote attackers to read arbitrary files outside the intended restricted directory, resulting in high-severity information disclosure. All releases from version 0 through v1.0.0 are affected, per EUVD-2026-52804 and the NVIDIA product security advisory. No public exploit code or active exploitation has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates low-complexity, authentication-free exploitation against any network-exposed instance.
Hash collision exploitation in NVIDIA Dynamo's multimodal embedding cache on Linux allows unauthenticated remote attackers to corrupt cached inference data by submitting specially crafted images. The cache fails to incorporate image dimensions into its hash function, meaning two images with identical pixel byte sequences but different spatial dimensions resolve to the same cache key, causing the wrong embedding to be served for subsequent requests. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the CVSS score of 7.5 with no authentication requirement (PR:N) elevates its priority in deployments where the inference API is network-accessible.
Out-of-bounds write in the multimodal serving topology of NVIDIA Dynamo for Linux allows remote unauthenticated attackers to corrupt memory, with a rated 9.8 CVSS potentially enabling remote code execution, privilege escalation, data tampering, information disclosure, and denial of service. NVIDIA (the reporting vendor) rates it critical with a network-reachable, no-privilege, no-interaction vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so the score reflects potential rather than observed impact.
Out-of-bounds write in NVIDIA Dynamo for Linux enables remote unauthenticated attackers to cause denial of service or tamper with data via network-reachable attack surface, scoring CVSS 8.2 High. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no special conditions, and no user interaction are required for exploitation. No public exploit code has been identified and CISA KEV listing is absent at time of analysis, but self-disclosure by NVIDIA and a High CVSS score warrant prompt patching in AI inference infrastructure environments.
Path traversal in NVIDIA Triton Inference Server's MLflow plugin allows a low-privileged local user to read, write, or modify files outside the designated model repository by embedding traversal sequences in a model name parameter. All Linux deployments of Triton Inference Server through version 26.02 are affected. No active exploitation has been confirmed (not listed in CISA KEV), EPSS is 0.16% (6th percentile), and SSVC rates exploitation status as none - indicating this is a real but currently low-observed-risk vulnerability that warrants patching on a standard cadence rather than emergency response.
Denial of service and information disclosure in NVIDIA DCGM Exporter allows remote unauthenticated attackers to consume server resources and potentially read runtime profiling data. The vulnerability resides in the /debug/pprof endpoints, which lack resource limits, enabling concurrent profiling requests to exhaust CPU and memory. No active exploitation has been observed, but the attack vector is network-accessible without credentials, earning a CVSS 8.2 score.
OS command injection in NVIDIA NeMo for Linux allows a local authenticated attacker to execute arbitrary commands, leading to full system compromise (code execution, privilege escalation, data tampering, and information disclosure). No public exploit code or active exploitation has been identified at the time of analysis.
Out-of-bounds array access in the Linux kernel PCI SR-IOV subsystem crashes the kernel when a GPU or other PCIe device becomes unresponsive during a power-state restore. Inside `sriov_restore_vf_rebar_state()` (drivers/pci/iov.c:948), if the VF Resizable BAR Control register returns PCI_ERROR_RESPONSE (0xffffffff), the 3-bit `nbars` and `bar_idx` fields both evaluate to 7, which exceeds the `barsz[]` array bound of 6 (PCI_SRIOV_NUM_BARS), triggering a UBSAN array-index-out-of-bounds kernel crash. Observed in production on NVIDIA RTX PRO 1000 (GB207GLM) hardware during a failed GC6 power-state exit; no public exploit code identified at time of analysis.
Memory corruption in FFmpeg 4.4 through 8.1.2 lets an attacker trigger a double-free in the NVIDIA NVDEC hardware decoder (libavcodec/nvdec.c) by getting a victim to process a crafted video file, potentially leading to code execution or crash in any NVDEC-accelerated pipeline. The flaw sits in the ff_nvdec_start_frame_sep_ref error path, which frees frame description data via nvdec_fdd_priv_free while the calling layer later frees the same object. No public exploit identified at time of analysis; a vendor upstream fix commit is available, and CVSS 4.0 is rated 8.7 (High).
Code execution in NVIDIA TensorRT is possible when the SDK processes a maliciously crafted input that overflows a heap-based buffer (CWE-122), corrupting adjacent heap memory. The flaw affects the TensorRT deep-learning inference library and requires a local user to load attacker-supplied content, per the AV:L/UI:R CVSS vector; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Successful exploitation yields full loss of confidentiality, integrity, and availability (C:H/I:H/A:H) in the context of the process running the inference job.
Local code execution in NVIDIA TensorRT is possible when the library parses an attacker-supplied input (such as a crafted model/engine file), triggering a heap-based buffer overflow (CWE-122) that can corrupt memory and lead to arbitrary code execution in the context of the process using TensorRT. The CVSS 3.1 vector (AV:L/UI:R) indicates the attacker needs local access and must induce a user or application to load malicious content, and there is no public exploit identified at time of analysis. TensorRT is NVIDIA's deep-learning inference SDK, so the affected population is developers, MLOps pipelines, and inference servers that load third-party or untrusted models.
Improper array index validation (CWE-129) in NVIDIA TensorRT allows an attacker to trigger out-of-bounds memory access that may lead to arbitrary code execution when a victim processes malicious input on the local host. The CVSS 3.1 vector (AV:L/UI:R) indicates the target must actively load attacker-controlled content, so exploitation hinges on tricking a user or automated pipeline into ingesting a crafted model or input file. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but with high confidentiality, integrity, and availability impact this is a meaningful priority for AI/ML inference environments.
Code execution in NVIDIA TensorRT (all versions through v10.16.1) arises from unsafe deserialization of untrusted data (CWE-502), letting an attacker who supplies a malicious serialized artifact run arbitrary code in the context of the inference process. It affects the TensorRT SDK/runtime used to optimize and execute deep-learning models. The vendor-assigned CVSS is 9.8, but there is no public exploit identified at time of analysis, EPSS is low (0.48%, 38th percentile), and CISA SSVC lists exploitation as 'none'.
Missing authentication in NVIDIA TensorRT-LLM for Linux lets an attacker reach the disaggregated orchestrator's FastAPI server directly and read, write, or delete internal cluster state, resulting in information disclosure, data tampering, and denial of service. The flaw (CWE-306) affects the orchestration layer that coordinates disaggregated prefill/decode inference workers. No public exploit identified at time of analysis, and the CVSS 3.1 base score is 7.3 with a local attack vector despite the request-based nature of the issue.
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (CWE-123), enabling arbitrary memory writes that can corrupt data, crash the inference service, or leak sensitive information. The flaw carries a CVSS 7.4 (High) score with a local attack vector and high attack complexity, and affects the TensorRT-LLM library used to build and serve optimized large-language-model inference on NVIDIA GPUs. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attacker corrupt heap memory by supplying a crafted serialized tensor, potentially causing information disclosure, data tampering, or denial of service. All platforms running affected TensorRT-LLM versions are impacted. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; NVIDIA rates exploitation as high-complexity (AC:H).
Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a host running the inference stack abuse its inter-process communication layer to trigger unsafe object deserialization (CWE-502), potentially yielding code execution, information disclosure, data tampering, and denial of service. The flaw is vendor-reported by NVIDIA and carries a CVSS 3.1 base of 7.8 (AV:L), meaning it is not remotely reachable but converts existing local access into full compromise of the model-serving process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Insecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the restricted unpickler that handles model-weight loading, potentially achieving code execution, privilege escalation, data tampering, and information disclosure. The flaw (CWE-502, CVSS 8.4) affects the GPU LLM-inference library and stems from the restricted unpickler failing to fully constrain what can be deserialized from an untrusted model artifact. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Denial of service in NVIDIA Triton Inference Server on Linux allows remote unauthenticated attackers to exhaust host memory by triggering a memory leak (CWE-401, missing release of memory after effective lifetime), degrading or crashing the inference service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H) indicates trivial network-reachable exploitation with no authentication and high availability impact, but no confidentiality or integrity exposure. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Denial of service in NVIDIA Triton Inference Server on Linux allows remote unauthenticated attackers to crash the service by triggering an uncaught exception (CWE-248), taking the model-serving endpoint offline. The flaw carries CVSS 7.5 with a pure availability impact (C:N/I:N/A:H) and no public exploit identified at time of analysis; it was reported by NVIDIA itself. No confidentiality or integrity compromise is involved — the sole consequence is loss of inference availability.
An authentication bypass in OpenBMC's phosphor-net-ipmid IPMI stack lets a network attacker with no credentials complete IPMI 2.0 RAKP session authentication and obtain full BMC control. A crafted RAKP Message 1 forces the handler to return before the authentication object's constructor defaults are overwritten, so the service accepts a RAKP Message 3 whose HMAC is keyed with the hard-coded 20-byte 'userKey' derived from the string '0penBmc' combined with an often-predictable 'bmcRandomNum'. The flaw affects downstream vendors that ship phosphor-net-ipmid as their IPMI implementation, including NVIDIA and H3C, and runZero published a public advisory; no CISA KEV entry or EPSS score was supplied, and no patched version was identified in the provided data.
Privilege escalation in OpenBMC's phosphor-net-ipmid IPMI stack allows an attacker who already holds a valid low-privileged IPMI session to redirect that session's authorization context to a different, higher-privileged account while the original integrity and encryption keys stay in place, so no re-authentication ever occurs. Downstream vendors that package phosphor-net-ipmid — NVIDIA and H3C among them — inherit the flaw in their BMC firmware. Rated CVSS 8.8 with high confidentiality, integrity and availability impact; no public exploit code identified at time of analysis, and the issue is not listed in CISA KEV.
Out-of-bounds read and write in the Linux kernel's forcedeth NVIDIA ethernet driver triggers on every S3 suspend/resume cycle due to an off-by-one loop terminator in nv_suspend() and nv_resume(). The loop runs one iteration past the end of the saved_config_space[] array, overwriting adjacent kernel memory (np->name_rx[]) and issuing a stray MMIO write one dword beyond the ioremap'd hardware window; with CONFIG_UBSAN_TRAP=y the kernel aborts during the suspend path. The bug has existed since Linux 2.6.27 but was only surfaced by UBSAN on Apple Macmini3,1 (MCP79) hardware during S3 cycling. No public exploit has been identified at time of analysis.
Missing authorization (CWE-862) in NVIDIA Triton Inference Server for Linux allows unauthenticated remote attackers to reach protected API endpoints without authorization checks. Per NVIDIA's own description, successful exploitation can lead to information disclosure, data tampering, and denial of service - though the vendor's CVSS vector scores only A:H (Availability: High), creating a notable discrepancy with the stated impact breadth. No public exploit code or CISA KEV listing exists at time of analysis.
Denial of service in NVIDIA Triton Inference Server for Linux allows unauthenticated remote attackers to exhaust server resources via a crafted request that triggers excessive iteration. All tracked versions under the wildcard CPE are potentially affected, and the vulnerability is network-reachable with no authentication or user interaction required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, data tampering, and information disclosure on the affected host. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H) indicates a local, low-complexity exploit path yielding full triad compromise - consistent with classic unsafe deserialization primitives that reconstruct attacker-controlled object graphs. No public exploit or CISA KEV listing has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, tamper with data, and disclose sensitive information. The vulnerability (CWE-502) exists in the Megatron Bridge component of NVIDIA's large-scale model training infrastructure, where attacker-controlled serialized input is processed without adequate validation. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-privilege access to achieve code execution, data tampering, and information disclosure on the host system. The vulnerability (CWE-502) is exploitable locally without user interaction, making it particularly relevant in multi-tenant high-performance compute environments where Megatron Bridge is used for large-scale model training pipelines. No public exploit code or active exploitation has been identified at time of analysis, but the full C/I/A impact triad elevates the urgency for affected deployments.
Local code execution in NVIDIA Megatron Bridge exploits unsafe deserialization of attacker-controlled data, allowing a low-privileged local user to achieve full process compromise with high confidentiality, integrity, and availability impact. The CVSS 7.8 (High) vector - AV:L/AC:L/PR:L/UI:N - confirms that no network exposure, user interaction, or elevated privileges are required beyond an initial local foothold. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE-capable impact class warrants prompt remediation in multi-user AI training environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes affected systems to code execution, data tampering, and information disclosure by a local low-privileged attacker. The flaw (CWE-502) allows a maliciously crafted serialized object to hijack the application's deserialization routine, granting the attacker the full CIA impact of the process context without requiring elevated privileges or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the high CIA impact and low attack complexity make this a meaningful priority for any organization running Megatron Bridge in multi-tenant or shared compute environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a low-privileged local user to achieve arbitrary code execution, data tampering, and information disclosure on the affected host. Reported directly by NVIDIA PSIRT (psirt@nvidia.com) and classified CWE-502, the flaw requires only local system access with standard user privileges, elevating insider threat and lateral-movement risk in shared AI training environments. No public exploit code or active exploitation has been confirmed at time of analysis, but the low attack complexity and full C/I/A impact make patching a real operational priority for any deployment.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, data tampering, and information disclosure on affected systems. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full CIA impact from a local, low-complexity attack requiring no user interaction, making this a meaningful privilege escalation and code execution risk in shared compute environments such as multi-tenant GPU training clusters. No public exploit code or CISA KEV listing has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local low-privileged attacker to achieve code execution, corrupt data, and exfiltrate sensitive information. The vulnerability (CWE-502) is exploitable locally with low privileges and no user interaction, yielding a CVSS 7.8 High rating with full confidentiality, integrity, and availability impact. No public exploit code has been identified at the time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes local users to code execution, data tampering, and information disclosure. An attacker with low-privileged local access can supply crafted serialized payloads to the Bridge component, which are deserialized without adequate validation. No public exploit code or active exploitation has been identified at time of analysis, but the high C/I/A impact and low-complexity exploitation path make this a meaningful risk in multi-tenant AI training environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes systems to local code execution, data tampering, and information disclosure from a low-privileged local user. The vulnerability (CWE-502) allows an attacker with local access to supply malicious serialized payloads that the bridge processes without sufficient validation. No public exploit or CISA KEV listing is identified at time of analysis, but the full-triad high-impact CVSS score (C:H/I:H/A:H) signals severe post-exploitation potential on any host running the component.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve code execution, data tampering, and information disclosure on the host system. The CVSS:3.1 vector (AV:L/PR:L) confirms this is a local-access vulnerability targeting NVIDIA's distributed large-model training infrastructure, where a compromised or malicious low-privileged user on the same host could supply a crafted serialized payload to the Bridge component. No public exploit or CISA KEV listing has been identified at time of analysis, but the full-triad impact (C:H/I:H/A:H) makes this a meaningful threat in multi-tenant AI training cluster environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve full system compromise, including arbitrary code execution, data tampering, and information disclosure. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N) confirms that exploitation requires local access with minimal privilege but no user interaction, making it a realistic threat in multi-tenant AI training environments where Megatron Bridge is used. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local low-privileged attacker to achieve arbitrary code execution, tamper with data, and disclose sensitive information on the affected host. The CVSS 7.8 score with local attack vector and low-privilege requirement indicates an authenticated local user can exploit the flaw without user interaction, fully compromising confidentiality, integrity, and availability. No public exploit or active exploitation has been identified at time of analysis, though the CIA triad is fully impacted on successful exploitation, making this a meaningful risk in shared compute environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local low-privileged attacker to achieve code execution, data tampering, and information disclosure with no user interaction required. The AV:L/PR:L CVSS vector confines the attack to actors who already hold a valid local account on the affected host, limiting but not eliminating real-world risk in shared AI infrastructure. No public exploit code has been identified, and this vulnerability has not been listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected system. The CVSS vector (AV:L/PR:L) confirms exploitation requires local access with standard user privileges, making this most relevant to shared multi-user HPC or AI/ML training cluster environments where multiple users interact with the same Megatron infrastructure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a low-privileged local attacker to achieve arbitrary code execution, data tampering, and information disclosure on affected systems. The flaw (CWE-502) requires only an authenticated local OS session - no elevated privileges or user interaction - making it exploitable by any standard user on a host running the Bridge component. Reported directly by NVIDIA PSIRT, no public exploit has been identified at the time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-level privileges to achieve code execution, data tampering, and information disclosure on the affected system. The CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector indicates exploitation requires only local, low-privileged access with no user interaction, making this a meaningful threat in multi-tenant AI training environments where shared compute access is common. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to execute arbitrary code, tamper with data, and disclose sensitive information on affected systems. The vulnerability stems from CWE-502 (Deserialization of Untrusted Data), where a crafted malicious payload supplied to the Bridge component triggers unsafe deserialization, granting the attacker full control over the vulnerable process. No public exploit or CISA KEV listing has been identified at time of analysis, but the high-impact CVSS 7.8 score reflects the severity of successful exploitation.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local low-privileged attacker to achieve code execution, tamper with data, and disclose sensitive information on the affected host. The CVSS:3.1 score of 7.8 (High) with a local attack vector reflects that exploitation requires an existing foothold on the system, but the low privilege requirement and no user interaction needed make post-access exploitation straightforward. No public exploit code or CISA KEV listing has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes systems to code execution, data tampering, and information disclosure when an attacker with local user access supplies a malicious serialized payload to the Bridge process. The local attack vector (AV:L) and low-privilege requirement (PR:L) place this vulnerability in the context of shared AI/ML training infrastructure - multi-tenant GPU clusters where lateral movement between users is the realistic threat model. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The CVSS 7.8 score (AV:L/PR:L) constrains exploitation to local contexts, but the high impact across all three CIA triad components reflects the severity of a successful exploit. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, tamper with data, and disclose sensitive information on affected systems. Rooted in CWE-502, the flaw arises when the bridge component deserializes attacker-influenced data without adequate validation - a well-understood attack class that is particularly dangerous in distributed AI training infrastructure where serialized model state or inter-process messages transit between components. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes AI training infrastructure to code execution, data tampering, and information disclosure by local low-privileged attackers. The vulnerability (CWE-502) resides in a bridge component of the Megatron-LM distributed training framework, used extensively in large-scale LLM training clusters. No public exploit code or CISA KEV listing has been identified at time of analysis; however, CVSS 7.8 (High) reflects the severity of a full triad (C:H/I:H/A:H) impact if exploitation succeeds.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker holding standard user privileges to achieve arbitrary code execution, data tampering, and information disclosure on the affected host. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the exploitation path is local and low-privilege - no network exposure or administrator rights are required, making insider threats, shared-access HPC environments, and compromised user accounts the primary risk vectors. No public exploit code or active exploitation has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The vulnerability (CWE-502) stems from the application accepting and processing serialized data without adequate validation, enabling crafted payloads to subvert normal deserialization logic. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full C:H/I:H/A:H impact triad indicates a severe outcome if exploited by a user with existing local access.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-privilege access to execute arbitrary code, tamper with data, and disclose sensitive information. The CVSS vector (AV:L/AC:L/PR:L) indicates the vulnerability is exploitable locally without elevated privileges or user interaction, making it a significant risk in multi-tenant distributed AI training environments where multiple users share infrastructure. No public exploit or KEV listing is confirmed at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The vulnerability carries a CVSS 3.1 score of 7.8 with a local attack vector, indicating that an attacker with an existing foothold on the system can escalate impact significantly. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full CIA triad impact (High/High/High) makes this a high-priority remediation target for any organization running Megatron Bridge in research or production AI training environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-privilege access to execute arbitrary code, tamper with application data, and exfiltrate sensitive information. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation is bounded to local authenticated users or processes, but the full C:H/I:H/A:H impact triad makes successful exploitation highly damaging within that local scope. No public exploit has been identified at time of analysis, and no CISA KEV listing has been observed.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The local attack vector (AV:L) and low-privilege requirement (PR:L) limit the attack surface to users or processes with existing system access, yet the full C:H/I:H/A:H impact triad makes successful exploitation highly consequential. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the NVIDIA PSIRT has published a security advisory via their product-security GitHub repository.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, data tampering, and sensitive information disclosure on the affected system. The CVSS 7.8 base score reflects a local attack vector requiring only low-privilege access with no user interaction, producing full high-impact compromise across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the severity of potential impact warrants prompt patching in AI training environments.
Unauthenticated access to the NVIDIA NemoClaw inference server on Linux exposes sensitive model inference data and enables denial of service by adjacent network attackers. The flaw stems from a missing authentication check (CWE-306) on the inference service endpoint, meaning any host on the same network segment can interact with the service without credentials. No active exploitation has been confirmed by CISA KEV and no public exploit code is known at time of analysis, but the low attack complexity and absence of authentication barriers make this straightforward to exploit for any attacker with adjacent network positioning.
Improper certificate validation in NVIDIA NemoClaw for Linux (versions up to and including 0.0.1) allows network attackers to intercept or manipulate the deployment process, potentially yielding information disclosure, data tampering, remote code execution, and privilege escalation. The flaw stems from the deployment routine failing to properly verify TLS certificates (CWE-295), enabling machine-in-the-middle attacks. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the vendor rates full technical impact.
Privilege escalation and remote code execution in NVIDIA OpenShell for Linux stem from an incomplete deny-list in its sandbox provisioning API, letting an authenticated attacker submit inputs that were meant to be blocked but were not. Because the flaw crosses the sandbox boundary (CVSS scope change), a successful exploit can yield code execution, privilege escalation, information disclosure, data tampering, and denial of service against the host. No public exploit identified at time of analysis, and the issue is not in CISA KEV.
Code injection in NVIDIA NemoClaw's migration command (Linux, versions up to 0.0.17) allows a local attacker with low-privilege access to inject and execute arbitrary code within the process context, yielding full confidentiality, integrity, and availability impact on the vulnerable system. SSVC rates technical impact as total, consistent with the CVSS 7.8 rating, though EPSS remains very low at 0.16% (5th percentile) and no active exploitation has been observed. No public exploit has been identified at time of analysis.
Untrusted code execution in NVIDIA NemoClaw for Linux (versions up to and including 0.0.21) stems from the installer executing code without verifying its integrity, letting an attacker who can supply or interpose malicious code during installation achieve arbitrary code execution, privilege escalation, data tampering, information disclosure, and denial of service. NVIDIA assigns a CVSS of 9.8 with a fully network-based, no-privilege, no-interaction vector, though the flaw is rooted in the install process. There is no public exploit identified at time of analysis, EPSS is low at 0.25% (17th percentile), and CISA SSVC records no known exploitation.
OS command injection in NVIDIA NemoClaw for Linux allows a local low-privileged attacker to execute arbitrary operating system commands through the application's status and logs plugin command interfaces. The CVSS 7.8 score reflects high impact across confidentiality, integrity, and availability with low attack complexity and no user interaction required. No public exploit identified at time of analysis, and no CISA KEV listing observed, but the fully unscopeed local impact makes this a meaningful risk on multi-tenant or shared Linux systems running NemoClaw.
OS command injection in NVIDIA NemoClaw's NIM management component on Linux enables a local authenticated attacker to execute arbitrary operating system commands with the privileges of the targeted process. All versions of NemoClaw are indicated as affected per NVD CPE data (wildcard version range). Successful exploitation can result in full code execution, persistent data tampering, sensitive information disclosure, and denial of service on the host. No public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in NVIDIA NemoClaw's command-line interface on Linux enables a local low-privileged attacker to execute arbitrary operating system commands, leading to full compromise of confidentiality, integrity, and availability. All versions of NemoClaw appear affected per the CPE wildcard (*), and the vulnerability is rooted in improper neutralization of user-supplied input passed to shell commands (CWE-78). No public exploit code and no CISA KEV listing have been identified at time of analysis, limiting current real-world risk primarily to environments with untrusted local users.
Weak authentication in NVIDIA NemoClaw for Linux (versions 0 through 0.0.4) lets remote attackers bypass the authentication enforced by its remote-access helper workflow, enabling code execution, information disclosure, and data tampering on the host. The flaw was self-reported by NVIDIA and carries a critical 9.8 CVSS rating with a fully unauthenticated network vector. No public exploit identified at time of analysis, and EPSS estimates only a 0.57% 30-day exploitation probability, so the raw severity outpaces observed real-world activity.
Unverified code download in NVIDIA NemoClaw installation scripts for Linux (versions 0.0.0 through 0.0.21) allows a network-positioned attacker to substitute malicious payloads during installation, enabling code execution, privilege escalation, information disclosure, and data tampering on the target host. The root cause is CWE-494: the installation pipeline fetches remote code without cryptographic integrity verification, leaving the download channel open to man-in-the-middle substitution or upstream server compromise. No public exploit has been identified at time of analysis; EPSS sits at 0.20% (9th percentile) and SSVC confirms Exploitation: none, placing this firmly in the theoretical high-severity category rather than an actively exploited threat.
OS command injection in NVIDIA NemoClaw's Telegram bridge component on Linux enables a local attacker with low-privileged access to execute arbitrary operating system commands. Exploitation yields full confidentiality, integrity, and availability compromise on the affected host, with potential for privilege escalation beyond the invoking user. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) and minimal privilege requirement (PR:L) lower the practical bar for exploitation once local access is obtained.
Sandbox escape in NVIDIA OpenShell for Linux lets a low-privileged actor already operating inside the sandbox break its isolation boundary, potentially achieving code execution, privilege escalation, data tampering, and information disclosure on the host. The flaw is rooted in an uncontrolled search path element (CWE-427), so a resource the sandbox loads can be redirected to attacker-supplied code. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the assigned 9.9 CVSS reflects the full compromise achievable once the sandbox boundary is breached.
Path traversal in NVIDIA OpenShell Sandbox for Linux permits low-privileged network-authenticated attackers to bypass L7 REST network policy enforcement, reaching REST endpoints that policy rules were designed to block. The Changed Scope (S:C) in the CVSS vector signals that the real impact falls on downstream services or data stores protected by the bypassed policy, yielding high confidentiality exposure (C:H) and limited integrity impact (I:L) on resources outside the sandbox trust boundary. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at time of analysis.
OS command injection in NVIDIA OpenShell across all supported platforms allows a network-accessible malicious gateway to execute arbitrary operating system commands on a victim host when a user interacts with that gateway. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects that an attacker requires no privileges on the victim system but does require the victim to interact with a malicious or attacker-controlled gateway endpoint. Successful exploitation yields full code execution, data tampering, and information disclosure - with no public exploit or CISA KEV listing identified at time of analysis.
Code injection in NVIDIA Unified Fabric Manager Enterprise's plugin management API allows low-privileged, adjacent-network authenticated users to execute arbitrary commands on the UFM host by submitting a specially crafted API request. All current release tracks - GA, LTS 2023, LTS 2024, and LTS 2025 - are confirmed affected per vendor-supplied CPE data. Successful exploitation yields code execution, privilege escalation, and information disclosure on a platform that controls InfiniBand fabric infrastructure, amplifying downstream impact on managed HPC and AI compute clusters. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in NVIDIA UFM Enterprise's web interface authorization component allows an attacker on the adjacent network to send specially crafted HTTP requests that circumvent authentication checks, yielding code execution and privilege escalation on the UFM management host. All four active release tracks - GA, LTS 2023, LTS 2024, and LTS 2025 - are listed as affected per NVD CPE data. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
NULL pointer dereference in NVIDIA DGX Spark system firmware enables a local privileged attacker to achieve code execution with scope change into other system components. All versions of the DGX Spark firmware are affected per the wildcard CPE, with potential impacts spanning code execution, privilege escalation, denial of service, information disclosure, and data tampering. No public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds write in NVIDIA DGX Spark system firmware enables a privileged local attacker to corrupt memory and achieve code execution, privilege escalation, denial of service, information disclosure, or data tampering. The CVSS scope-change indicator (S:C) is the critical risk amplifier here - successful exploitation can breach the firmware's security boundary and affect components outside it, including potentially the host OS or hypervisor layer. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Out-of-bounds write in NVIDIA DGX Spark system firmware permits a locally authenticated, highly privileged attacker to corrupt firmware memory in a way that crosses the firmware's isolation boundary into the broader system. Successful exploitation may yield arbitrary code execution, privilege escalation beyond the initial firmware context, denial of service, information disclosure, and data tampering - all stemming from a single CWE-787 write primitive. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope-changing nature of the CVSS vector (S:C) elevates the potential blast radius significantly for affected AI compute infrastructure.
Denial of service in NVIDIA Triton Inference Server for Linux exposes AI inference infrastructure to remote disruption through improper input validation. Unauthenticated network attackers can crash or render unresponsive the inference server by submitting malformed inputs, with CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) confirming no authentication or user interaction is required. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the low attack complexity and zero-authentication requirement make this a meaningful availability risk for any Triton deployment reachable from untrusted networks.
Unbounded resource allocation in NVIDIA Triton Inference Server for Linux allows remote, unauthenticated attackers to exhaust server-side resources and cause denial of service against all tracked versions (CPE wildcard). The CVSS 7.5 High rating reflects a fully network-accessible attack path with no privileges or user interaction required, making the exposure surface broad for any Triton deployment reachable from untrusted networks. No public exploit code has been identified at time of analysis, and exploitation has not been confirmed by CISA KEV.
Path traversal in NVIDIA Triton Inference Server for Linux (CWE-22) lets remote attackers manipulate file paths to reach locations outside intended directories, with the vendor citing denial of service as the primary outcome. NVIDIA assigned a critical 9.8 CVSS score claiming full confidentiality, integrity, and availability impact, though the published description only asserts DoS. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Absolute path traversal in NVIDIA Triton Inference Server for Linux (versions 0.0 through 26.05) lets remote unauthenticated attackers reference filesystem paths outside intended directories, per NVIDIA's own advisory. NVIDIA states a successful exploit may lead to information disclosure and potentially code execution. No public exploit has been identified at time of analysis, and EPSS is low at 0.41% (34th percentile).
Privilege escalation in NVIDIA NVOS network switch operating system occurs when PKA-only SSH mode is enabled, inadvertently activating a secondary authentication channel that can be exploited if the default device password has not been rotated per NVIDIA's hardening guidance. An adjacent-network attacker who discovers this condition can authenticate via the alternative path using default credentials, bypassing the intended PKA-only enforcement and gaining elevated access to the switch. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at time of analysis, but the infrastructure impact of a compromised network switch is significant.
Buffer overflow in the LLDP daemon of NVIDIA Cumulus Linux enables an unauthenticated attacker with Layer 2 network adjacency to achieve code execution by sending specially crafted LLDP frames. Both the GA track (all versions through 5.16) and LTS track (through 5.11.5 and 5.9.5 respectively) are confirmed affected. No active exploitation or public proof-of-concept code has been identified at time of analysis, though CISA SSVC rates the technical impact as total given that a successful exploit yields full switch compromise.
Local privilege escalation in NVIDIA Cumulus Linux exposes network switch operating systems to full compromise by unprivileged local users. The flaw resides in the user management component, where improper privilege assignment (CWE-250) allows a low-privileged authenticated user to escalate to higher privilege levels - likely root - with low attack complexity and no user interaction required. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the CVSS 7.8 High score reflects the full triad impact once local access is obtained.
Canonical LXD's NVIDIA GPU passthrough configuration handler fails to sanitize newline characters in user-supplied `nvidia.driver.capabilities` and `nvidia.require.*` instance config values, enabling an authenticated attacker to inject arbitrary directives into the generated `lxc.conf` file. Any LXD user with instance-creation or configuration-modification privileges can exploit this to escape the container boundary and execute arbitrary commands on the host with the full privileges of the LXD daemon - effectively achieving complete host compromise. No public exploit code or CISA KEV listing exists at time of analysis, but the network-accessible, low-privilege attack path and scope-changed CVSS vector reflect an elevated real-world threat for shared or multi-tenant LXD deployments.
Deserialization of untrusted data in NVIDIA Dynamo for Linux (versions 0 through v1.1.0) exposes unauthenticated remote attackers to denial-of-service conditions and data integrity compromise. The flaw is rooted in CWE-502 - unsafe handling of externally supplied serialized objects - and carries a CVSS 8.2 score driven by a fully unauthenticated, low-complexity network attack vector. No public exploit code and no active exploitation have been identified at time of analysis, but the absence of authentication and configuration prerequisites makes the attack surface broad for any internet-accessible Dynamo deployment.
Remote code execution, data tampering, denial of service, and information disclosure are possible through vulnerabilities in NVIDIA Dynamo for Linux examples and recipes, affecting all versions through v1.1.0. The root cause is CWE-1357 (Relies on Insufficiently Trustworthy Component), meaning the examples or recipes bundle or reference a dependency or component without adequate integrity or trust verification, enabling an attacker to exploit that trust boundary over a network. No public exploit code exists and no active exploitation has been confirmed; EPSS places probability at 0.36% (29th percentile) and SSVC confirms exploitation status as none with a non-automatable attack path, suggesting low near-term weaponization risk despite the high CVSS base score.
Server-side request forgery in NVIDIA Dynamo's Rust multimodal media fetcher (Linux, versions through v1.1.0) allows unauthenticated remote attackers to coerce the server into issuing arbitrary HTTP requests to attacker-controlled destinations. A successful exploit can expose sensitive internal network resources, cloud metadata endpoints (e.g., IMDS at 169.254.169.254), or internal API responses, resulting in high-confidence information disclosure. No public exploit code or CISA KEV listing exists at time of analysis.
Server-side request forgery via DNS rebinding in NVIDIA Dynamo's multimodal media fetcher exposes internal network resources to remote unauthenticated attackers. All Dynamo releases from version 0 through v1.1.0 on Linux are affected. A successful exploit allows an attacker to manipulate the media fetcher into issuing HTTP requests to internal services, leading to high-confidence information disclosure - including potentially cloud metadata endpoints, internal APIs, or adjacent microservices. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the CVSS 7.5 rating and unauthenticated network vector make this a meaningful risk in exposed deployments.
Server-side request forgery in NVIDIA Dynamo's multimodal media fetcher (Linux, versions through v1.1.0) allows unauthenticated remote attackers to issue arbitrary server-side HTTP requests by supplying malicious URLs as media inputs during inference. The CVSS 3.1 vector confirms network-accessible, zero-authentication exploitation with high confidentiality impact, scoring 7.5. No active exploitation or public exploit code has been identified at time of analysis, but SSRF in cloud-hosted AI inference infrastructure carries meaningful risk due to cloud metadata service exposure.
Server-side request forgery in NVIDIA Dynamo for Linux (all versions through v1.1.0) allows unauthenticated remote attackers to force the inference server to issue arbitrary HTTP requests by embedding a crafted URL inside a multimodal inference request payload. Successful exploitation exposes internal network resources reachable from the Dynamo host, producing high-severity information disclosure without requiring any credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the PR:N/AC:L attack surface on AI serving endpoints that may be network-exposed warrants prompt remediation.
Server-side request forgery in NVIDIA Dynamo for Linux (versions 0 through v1.1.0) enables unauthenticated remote attackers to cause the server to issue arbitrary backend HTTP requests. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-exploitable with no authentication or user interaction required, making this accessible to any attacker who can reach the Dynamo service. Successful exploitation leads to confidentiality impact - likely exposure of internal services, cloud instance metadata endpoints, or internal API responses - with no public exploit or CISA KEV listing identified at time of analysis.
Server-side request forgery in NVIDIA Dynamo for Linux (versions through v1.1.0) allows unauthenticated remote attackers to read arbitrary local files by embedding a crafted local path inside a multimodal inference request. The Dynamo serving layer fails to restrict the path to an allowed directory, causing the server to resolve and return content from restricted filesystem locations, leading to high-confidentiality information disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity and lack of authentication requirements make this straightforward to exploit against any exposed Dynamo endpoint.
Path traversal in NVIDIA Dynamo's image loading component on Linux enables unauthenticated remote attackers to read arbitrary files outside the intended restricted directory, resulting in high-severity information disclosure. All releases from version 0 through v1.0.0 are affected, per EUVD-2026-52804 and the NVIDIA product security advisory. No public exploit code or active exploitation has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates low-complexity, authentication-free exploitation against any network-exposed instance.
Hash collision exploitation in NVIDIA Dynamo's multimodal embedding cache on Linux allows unauthenticated remote attackers to corrupt cached inference data by submitting specially crafted images. The cache fails to incorporate image dimensions into its hash function, meaning two images with identical pixel byte sequences but different spatial dimensions resolve to the same cache key, causing the wrong embedding to be served for subsequent requests. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the CVSS score of 7.5 with no authentication requirement (PR:N) elevates its priority in deployments where the inference API is network-accessible.
Out-of-bounds write in the multimodal serving topology of NVIDIA Dynamo for Linux allows remote unauthenticated attackers to corrupt memory, with a rated 9.8 CVSS potentially enabling remote code execution, privilege escalation, data tampering, information disclosure, and denial of service. NVIDIA (the reporting vendor) rates it critical with a network-reachable, no-privilege, no-interaction vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so the score reflects potential rather than observed impact.
Out-of-bounds write in NVIDIA Dynamo for Linux enables remote unauthenticated attackers to cause denial of service or tamper with data via network-reachable attack surface, scoring CVSS 8.2 High. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no special conditions, and no user interaction are required for exploitation. No public exploit code has been identified and CISA KEV listing is absent at time of analysis, but self-disclosure by NVIDIA and a High CVSS score warrant prompt patching in AI inference infrastructure environments.
Path traversal in NVIDIA Triton Inference Server's MLflow plugin allows a low-privileged local user to read, write, or modify files outside the designated model repository by embedding traversal sequences in a model name parameter. All Linux deployments of Triton Inference Server through version 26.02 are affected. No active exploitation has been confirmed (not listed in CISA KEV), EPSS is 0.16% (6th percentile), and SSVC rates exploitation status as none - indicating this is a real but currently low-observed-risk vulnerability that warrants patching on a standard cadence rather than emergency response.
Denial of service and information disclosure in NVIDIA DCGM Exporter allows remote unauthenticated attackers to consume server resources and potentially read runtime profiling data. The vulnerability resides in the /debug/pprof endpoints, which lack resource limits, enabling concurrent profiling requests to exhaust CPU and memory. No active exploitation has been observed, but the attack vector is network-accessible without credentials, earning a CVSS 8.2 score.
OS command injection in NVIDIA NeMo for Linux allows a local authenticated attacker to execute arbitrary commands, leading to full system compromise (code execution, privilege escalation, data tampering, and information disclosure). No public exploit code or active exploitation has been identified at the time of analysis.
Out-of-bounds array access in the Linux kernel PCI SR-IOV subsystem crashes the kernel when a GPU or other PCIe device becomes unresponsive during a power-state restore. Inside `sriov_restore_vf_rebar_state()` (drivers/pci/iov.c:948), if the VF Resizable BAR Control register returns PCI_ERROR_RESPONSE (0xffffffff), the 3-bit `nbars` and `bar_idx` fields both evaluate to 7, which exceeds the `barsz[]` array bound of 6 (PCI_SRIOV_NUM_BARS), triggering a UBSAN array-index-out-of-bounds kernel crash. Observed in production on NVIDIA RTX PRO 1000 (GB207GLM) hardware during a failed GC6 power-state exit; no public exploit code identified at time of analysis.
Memory corruption in FFmpeg 4.4 through 8.1.2 lets an attacker trigger a double-free in the NVIDIA NVDEC hardware decoder (libavcodec/nvdec.c) by getting a victim to process a crafted video file, potentially leading to code execution or crash in any NVDEC-accelerated pipeline. The flaw sits in the ff_nvdec_start_frame_sep_ref error path, which frees frame description data via nvdec_fdd_priv_free while the calling layer later frees the same object. No public exploit identified at time of analysis; a vendor upstream fix commit is available, and CVSS 4.0 is rated 8.7 (High).
Code execution in NVIDIA TensorRT is possible when the SDK processes a maliciously crafted input that overflows a heap-based buffer (CWE-122), corrupting adjacent heap memory. The flaw affects the TensorRT deep-learning inference library and requires a local user to load attacker-supplied content, per the AV:L/UI:R CVSS vector; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Successful exploitation yields full loss of confidentiality, integrity, and availability (C:H/I:H/A:H) in the context of the process running the inference job.
Local code execution in NVIDIA TensorRT is possible when the library parses an attacker-supplied input (such as a crafted model/engine file), triggering a heap-based buffer overflow (CWE-122) that can corrupt memory and lead to arbitrary code execution in the context of the process using TensorRT. The CVSS 3.1 vector (AV:L/UI:R) indicates the attacker needs local access and must induce a user or application to load malicious content, and there is no public exploit identified at time of analysis. TensorRT is NVIDIA's deep-learning inference SDK, so the affected population is developers, MLOps pipelines, and inference servers that load third-party or untrusted models.
Improper array index validation (CWE-129) in NVIDIA TensorRT allows an attacker to trigger out-of-bounds memory access that may lead to arbitrary code execution when a victim processes malicious input on the local host. The CVSS 3.1 vector (AV:L/UI:R) indicates the target must actively load attacker-controlled content, so exploitation hinges on tricking a user or automated pipeline into ingesting a crafted model or input file. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but with high confidentiality, integrity, and availability impact this is a meaningful priority for AI/ML inference environments.
Code execution in NVIDIA TensorRT (all versions through v10.16.1) arises from unsafe deserialization of untrusted data (CWE-502), letting an attacker who supplies a malicious serialized artifact run arbitrary code in the context of the inference process. It affects the TensorRT SDK/runtime used to optimize and execute deep-learning models. The vendor-assigned CVSS is 9.8, but there is no public exploit identified at time of analysis, EPSS is low (0.48%, 38th percentile), and CISA SSVC lists exploitation as 'none'.
Missing authentication in NVIDIA TensorRT-LLM for Linux lets an attacker reach the disaggregated orchestrator's FastAPI server directly and read, write, or delete internal cluster state, resulting in information disclosure, data tampering, and denial of service. The flaw (CWE-306) affects the orchestration layer that coordinates disaggregated prefill/decode inference workers. No public exploit identified at time of analysis, and the CVSS 3.1 base score is 7.3 with a local attack vector despite the request-based nature of the issue.
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (CWE-123), enabling arbitrary memory writes that can corrupt data, crash the inference service, or leak sensitive information. The flaw carries a CVSS 7.4 (High) score with a local attack vector and high attack complexity, and affects the TensorRT-LLM library used to build and serve optimized large-language-model inference on NVIDIA GPUs. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attacker corrupt heap memory by supplying a crafted serialized tensor, potentially causing information disclosure, data tampering, or denial of service. All platforms running affected TensorRT-LLM versions are impacted. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; NVIDIA rates exploitation as high-complexity (AC:H).
Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a host running the inference stack abuse its inter-process communication layer to trigger unsafe object deserialization (CWE-502), potentially yielding code execution, information disclosure, data tampering, and denial of service. The flaw is vendor-reported by NVIDIA and carries a CVSS 3.1 base of 7.8 (AV:L), meaning it is not remotely reachable but converts existing local access into full compromise of the model-serving process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Insecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the restricted unpickler that handles model-weight loading, potentially achieving code execution, privilege escalation, data tampering, and information disclosure. The flaw (CWE-502, CVSS 8.4) affects the GPU LLM-inference library and stems from the restricted unpickler failing to fully constrain what can be deserialized from an untrusted model artifact. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Denial of service in NVIDIA Triton Inference Server on Linux allows remote unauthenticated attackers to exhaust host memory by triggering a memory leak (CWE-401, missing release of memory after effective lifetime), degrading or crashing the inference service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H) indicates trivial network-reachable exploitation with no authentication and high availability impact, but no confidentiality or integrity exposure. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Denial of service in NVIDIA Triton Inference Server on Linux allows remote unauthenticated attackers to crash the service by triggering an uncaught exception (CWE-248), taking the model-serving endpoint offline. The flaw carries CVSS 7.5 with a pure availability impact (C:N/I:N/A:H) and no public exploit identified at time of analysis; it was reported by NVIDIA itself. No confidentiality or integrity compromise is involved — the sole consequence is loss of inference availability.