CVE-2024-0110 is a medium severity (CVSS 4.4) out of bounds write in the cuobjdump command of NVIDIA CUDA Toolkit. Passing a malformed ELF file can trigger it. NVIDIA lists all versions up to and including 12.6 as affected and CUDA Toolkit 12.6U1 as the fixed release.
What's affected
NVIDIA bulletin 5564 covers the CUDA Toolkit on Windows and Linux. All versions up to and including 12.6 are affected, and earlier releases are affected too. The fixed version is CUDA Toolkit 12.6U1.
The affected part is the cuobjdump tool, which inspects the contents of CUDA binaries. It is a developer tool, so the exposure sits on build machines, CI runners and developer workstations, not on production servers that only run compiled code.
How to check if you're exposed
Check the CUDA Toolkit version.
nvcc --version
cuobjdump --version
Both report the toolkit release. Also search build images and CI runner images, since toolkits are often baked into container images. A scan of your container images for the CUDA toolkit packages helps here.
What to do now
- Find CUDA Toolkit installs on developer machines, CI runners and build images.
- Update to 12.6U1 or later.
- Until then, do not run cuobjdump on ELF files from untrusted sources.
- Rebuild base images that include the toolkit so new builds pick up the fix.
Why it matters
The weakness is CWE-787, out of bounds write. The tool writes outside the memory it allocated while parsing a malformed file. NVIDIA lists code execution or denial of service as possible outcomes.
The vector is local, needs user interaction, and rates each impact low, which gives 4.4. The risk grows when a pipeline automatically inspects binaries from outside sources, for example third party artifacts. The record does not show exploitation in the wild. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan, and the Gold directory lists the CVE and CWE pages used here.
Quick check
Is this a runtime risk for GPU servers?
The flaw is in the cuobjdump developer tool, so it matters most where that tool is run, on build and developer machines.
What triggers it?
NVIDIA says passing a malformed ELF file to the tool. We do not describe how to craft one.
Sources
Last reviewed: 19 October 2026.
