Cyber Posture

CVE-2026-24151

High

Published: 24 March 2026

Published
24 March 2026
Modified
25 March 2026
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0006 19.5th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-24151 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Nvidia Megatron-Lm. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 19.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly prevents deserialization of untrusted data by requiring validation and sanitization of inputs to NVIDIA Megatron-LM inferencing.

prevent

Remediates the specific CWE-502 deserialization flaw in Megatron-LM through timely identification, reporting, and patching.

prevent

Enforces least privilege to mitigate privilege escalation and limit damage from RCE triggered by malicious input processing.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

Deserialization vuln (CWE-502) in Megatron-LM inferencing enables RCE when a user loads a malicious crafted input file; directly maps to client-side exploitation (T1203) and user execution of malicious file (T1204.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

NVIDIA Megatron-LM contains a vulnerability in inferencing where an Attacker may cause an RCE by convincing a user to load a maliciously crafted input. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure,…

more

and data tampering.

Deeper analysisAI

CVE-2026-24151 is a vulnerability in NVIDIA Megatron-LM, specifically within its inferencing component. An attacker can cause remote code execution (RCE) by convincing a user to load a maliciously crafted input. The issue stems from CWE-502 (Deserialization of Untrusted Data) and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact with local access, low complexity, and low privileges required.

A local attacker with low privileges can exploit this vulnerability by socially engineering a user to process the malicious input during Megatron-LM inferencing. Successful exploitation enables arbitrary code execution, privilege escalation, information disclosure, and data tampering on the affected system.

Mitigation details are available in official advisories, including the NVIDIA security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5769, the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-24151, and the CVE record at https://www.cve.org/CVERecord?id=CVE-2026-24151.

This vulnerability affects an AI/ML framework used for large language model inferencing, underscoring risks associated with untrusted inputs in such pipelines. No information on real-world exploitation is available in the provided details.

Details

CWE(s)

Affected Products

nvidia
megatron-lm
≤ 0.15.3

CVEs Like This One

CVE-2025-33248Same product: Nvidia Megatron-Lm
CVE-2026-24150Same product: Nvidia Megatron-Lm
CVE-2026-24152Same product: Nvidia Megatron-Lm
CVE-2025-33247Same product: Nvidia Megatron-Lm
CVE-2025-33253Same vendor: Nvidia
CVE-2025-33252Same vendor: Nvidia
CVE-2025-33210Same vendor: Nvidia
CVE-2025-33241Same vendor: Nvidia
CVE-2025-33245Same vendor: Nvidia
CVE-2026-24165Same vendor: Nvidia

References