CVE-2026-24180: NVIDIA DALI contains a vulnerability in a component where an attacker could cause a heap-based buffer overflow

Synopsis

A heap-based buffer overflow exists in NVIDIA DALI, the GPU-accelerated data-loading library used in machine learning pipelines. The vulnerability is reachable locally and requires a low-privilege account plus a victim to perform an action, derived from the CVSS vector (AV:L/PR:L/UI:R). Successful exploitation gives an attacker full code execution on the host, the ability to tamper with data, crash the service, and read sensitive information. HarborGuard is tracking the upstream advisory and will make a patched-image rebuild available as soon as NVIDIA publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required to reach the vulnerable component.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrative or elevated credentials.

• Victim interactionRequired

  A user on the system must perform some action (such as opening a crafted file or triggering a pipeline operation) for the overflow to be triggered.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Executes arbitrary code in the context of the process running NVIDIA DALI, giving the attacker a foothold on the host.
• Modifies in-memory or persisted data handled by the DALI pipeline, corrupting model inputs or training data.
• Crashes the DALI process, disrupting GPU-accelerated data-loading and halting dependent training or inference workloads.
• Reads memory contents accessible to the DALI process, which may include model weights, data batches, or credentials present in the process address space.