SB2026051884 - Multiple vulnerabilities in NVIDIA NeMo Framework (March 2026)

Description

This security bulletin contains information about 2 vulnerabilities.

1) Deserialization of Untrusted Data (CVE-ID: CVE-2026-24157)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to deserialization of untrusted data in checkpoint loading when loading a crafted checkpoint. A local user can load a specially crafted checkpoint to execute arbitrary code.

The advisory states that successful exploitation may also lead to information disclosure, data tampering, and escalation of privileges.

2) Deserialization of Untrusted Data (CVE-ID: CVE-2026-24159)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to deserialization of untrusted data in the NeMo Framework when processing crafted input. A local user can provide crafted input to execute arbitrary code.

The advisory states that successful exploitation may also lead to information disclosure, data tampering, and escalation of privileges.

Remediation

Install update from vendor's website.

References

• https://nvidia.custhelp.com/app/answers/detail/a_id/5800
• https://www.nvidia.com/security/