CVE-2026-24159 is a deserialization flaw (CVSS 7.8) in the NVIDIA NeMo Framework that may allow remote code execution, privilege escalation, data tampering and information disclosure. NVIDIA's March 2026 bulletin lists all versions before 2.6.2 as affected. Update to 2.6.2 or later, and load only checkpoints from sources you trust.
What's affected
NVIDIA NeMo Framework, all platforms, all versions before 2.6.2. NVIDIA's bulletin (updated 1 July 2026) gives 2.6.2 as the updated version for both this CVE and CVE-2026-24157. NVIDIA's text for this one is brief and does not name the component, so rely on the bulletin.
How to check if you're exposed
pip show nemo_toolkit
Check notebooks, training containers and shared GPU servers, and the lock files of projects that depend on NeMo. Then list where your checkpoints and model files come from. Files from public hubs, partners or users carry more risk than files you trained yourself.
What to do now
- Update NeMo Framework to 2.6.2 or later.
- Load checkpoints only from sources you trust, and keep a record of their origin.
- Prefer weight formats that do not execute code when loaded, where your workflow allows it.
- Run training and evaluation jobs with limited privileges and without cloud credentials in their environment.
- Rebuild container images that include NeMo.
Why it matters
The weakness is CWE-502, deserialization of untrusted data. Many machine learning checkpoints use serialization formats that can run code while they load. A model file is therefore an executable artifact, and it belongs in your supply chain inventory.
The vector in the record needs local access and user interaction, which matches the case of a person loading a file. The record does not list this CVE as known exploited.
Reading the severity score
The record gives a CVSS base score of 7.8, published 2026-03-24. In the vector, the attacker works with local access, needs a low privilege account, and the attack is low in complexity. User interaction is not needed. Impact on confidentiality is high, on integrity high and on availability high.
A base score describes the flaw in general, not your risk. Weigh it against how exposed your instance is and what it can reach. The Gold page for the CVE keeps the score, weakness and references together.
Find it across your own code
To see which of your packages are affected, the free in-browser dependency scan at gold.safeguard.sh/scan takes a manifest and lists known vulnerabilities. Reachability analysis then helps you judge whether your code calls the vulnerable path, so you can order the work.
Quick check
Is a model checkpoint just data?
Not always. If the loader deserializes objects, a crafted checkpoint can run code when it is opened, which is what this class of flaw is about.
Sources
Last reviewed: 19 October 2026.
