CVE-2026-65082 is a high severity (CVSS 7.0) code injection flaw in the migration command of NVIDIA NemoClaw for Linux. A local attacker could achieve code execution, data tampering, information disclosure and denial of service. NVIDIA's August 2026 bulletin lists the fix.
What's affected
The NVIDIA bulletin (security bulletin for NemoClaw and OpenShell, updated 25 August 2026) lists NemoClaw on Linux with affected versions 0 to 0.0.17 and an updated version of 0.0.17, tied to commit 7983fc7d1. The weakness is CWE-94 (improper control of code generation). The score is 7.0 in both the record and the bulletin.
The bulletin's version columns read oddly, since the last affected version and the updated version are both 0.0.17. Do not guess which build is safe. Update to the latest release from the NVIDIA NemoClaw repository and check the commit and version against the bulletin. The record also lists the Linux kernel among its products. The bulletin shows the vulnerable software is the NVIDIA product on Linux, not the kernel itself.
The vector is local, high complexity, low privileges and no user interaction, with high impact on confidentiality, integrity and availability. The reporter is credited in the bulletin.
How to check if you're exposed
Check how NemoClaw is installed and which version you have.
nemoclaw --version 2>/dev/null
git -C /path/to/NemoClaw log -1 --format=%h 2>/dev/null
Compare the version and commit with the bulletin. NVIDIA says to clone or update the software from the NVIDIA NemoClaw repository on GitHub. If you installed from a script a while ago, you may be on an older copy.
Whatever the product, a current inventory of what you run is what turns a CVE notice into a quick answer. The Gold page for this CVE tracks how its record changes over time, and the free in-browser dependency scan at gold.safeguard.sh/scan covers the application libraries you ship.
What to do now
- Find every system that has NemoClaw installed and its version or commit.
- Update from the official NVIDIA repository and confirm the commit against the bulletin.
- Be careful with the migration command until you have updated, and do not run it on input you did not create.
- Limit local access to hosts that run NemoClaw to users who need it.
- Subscribe to NVIDIA's product security notices. This bulletin covered 18 CVEs across NemoClaw and OpenShell, so check your other NVIDIA components as well.
Why it matters
Code injection happens when a program builds a command or script from input and then runs it. The migration command is a place where data from older setups is read and acted on, which is a natural spot for a trust mistake. The class is CWE-94.
The local vector limits who can reach it, but local does not mean harmless on shared machines or in automation that runs untrusted input. The record does not list the CVE as exploited in the wild.
Quick check
Is this a Linux kernel vulnerability?
No. The record lists the Linux kernel as a platform, but the bulletin names the NVIDIA NemoClaw product on Linux as the affected software.
Sources
Last reviewed: 18 October 2026.
