CVE-2026-24255
Nvidia Dynamo ≤ 1.1.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NSummary
CVE-2026-24255 is a high-severity Incomplete Comparison with Missing Factors (CWE-1023) vulnerability in Nvidia Dynamo. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Masquerading (T1036); ranked at the 31th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-52803
Vulnerability Data
NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submitting images that share an identical pixel byte sequence but have different dimensions. A successful exploit of this vulnerability…
more
might lead to data tampering.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V6.3.4V6.3.5V6.1.3V6.5.7
Mitigating Controls (NIST 800-53 r5) AI
Mandating that access-control decisions apply the full set of required rules to each request structurally eliminates missing-factor comparisons.
Access enforcement requires that every authorization decision evaluate all relevant entity attributes, directly stopping incomplete comparisons from being used.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices (reviews, testing, static analysis) directly prevent incomplete comparison flaws from being introduced.
Authentication decisions often rely on multi-factor comparisons; incomplete comparisons directly weaken this control.
Enforcing access policy requires complete evaluation of all relevant attributes; missing factors undermine authorization decisions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing comparison factors, yet testing is only one part of the control's scope.
Application security requirements can mandate complete multi-factor comparisons, but the control is broader than this single weakness.
Secure architecture principles can require exhaustive entity comparisons, yet the control addresses many other design concerns.
Secure coding standards can forbid incomplete comparisons, but the control covers a wide range of coding issues.