NVIDIA Dynamo Code Execution Flaw CVE-2026-24254 CVSS 9.8

TL;DR

NVIDIA recently published an urgent software update for NVIDIA Dynamo for Linux. This update patches several security issues, including a critical NVIDIA Dynamo flaw. The most severe vulnerability carries a maximum CVSS score of 9.8.

Notable CVEs

Why It Matters

NVIDIA Dynamo plays a key role in artificial intelligence workflows. Many enterprise organizations rely on it for machine learning operations. An attacker can exploit these vulnerabilities to compromise a system. They can trigger remote code execution, steal sensitive data, or crash services. Currently, researchers have not confirmed any active exploitation in the wild. Furthermore, no public proof-of-concept exploit code exists for these bugs. However, the high CVSS scores make this a prime target for future attacks. The exact number of affected user installations remains undisclosed. Administrators must prioritize these security fixes immediately.

How The Attack Works

Attackers have multiple ways to exploit this software.

Out-of-Bounds Write

The most critical NVIDIA Dynamo flaw is CVE-2026-24254. This bug exists within the multimodal serving topology. An attacker sends a malicious request to cause an out-of-bounds write. This memory corruption allows arbitrary code execution and privilege escalation.

Server-Side Request Forgery

Several other bugs involve server-side request forgery. Attackers can supply a crafted URL within a multimodal request. They can also use DNS rebinding techniques against the media fetcher. These actions trick the server into exposing internal information.

Race Conditions and Hash Collisions

Other flaws exist in the LORA manager initialization. An attacker can easily trigger a race condition here. This action leads directly to data tampering and denial of service. Attackers can also submit manipulated images to cause a hash collision.

Affected Versions

These vulnerabilities impact various builds of NVIDIA Dynamo for Linux. Versions 0 to v1.1.0 contain the critical code execution flaw. Specifically, builds 0 to v1.0.0 suffer from the image loading path bug. Additionally, versions 0 to v1.2.0 contain the LORA manager race conditions.

Patch Or Mitigation Steps

Users must update their software immediately. You should pull the latest release from the official GitHub repository. Update to version 1.1.1 to fix CVE-2026-24254 and memory bugs. Administrators should install version 1.2.0 to patch the SSRF and path flaws. Finally, upgrade to version 1.3.0 to resolve the race conditions. Currently, NVIDIA provides no alternative mitigation steps. Patching is the only reliable defense.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.