CVE-2026-24164
Published: 31 March 2026
Summary
CVE-2026-24164 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Nvidia Bionemo Framework. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly mitigates this deserialization vulnerability by applying vendor patches to prevent exploitation.
Information input validation prevents deserialization of untrusted data by checking and rejecting malformed or malicious inputs.
Memory protection mechanisms like non-executable memory and ASLR mitigate arbitrary code execution resulting from deserialization exploits.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Deserialization of untrusted data vulnerability in network-accessible NVIDIA BioNeMo service (AV:N/PR:N) enables unauthenticated remote code execution with user interaction, directly facilitating T1190: Exploit Public-Facing Application.
NVD Description
NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.
Deeper analysisAI
CVE-2026-24164 is a vulnerability in NVIDIA BioNeMo that enables deserialization of untrusted data, corresponding to CWE-502: Deserialization of Untrusted Data. Published on 2026-03-31, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability.
The vulnerability can be exploited by any unauthenticated attacker over the network with low complexity, though it requires user interaction to trigger. A successful attack might result in arbitrary code execution, denial of service, information disclosure, or data tampering on the affected system.
Mitigation guidance and additional details are available in official advisories, including the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-24164, NVIDIA's security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5808, and the CVE record at https://www.cve.org/CVERecord?id=CVE-2026-24164.
Details
- CWE(s)