CVE-2026-24221

7.8 HIGH

NVIDIA NVTabular contains a vulnerability where an attacker could cause improper deserialization of untrusted data

Published: 2026-06-02 · Last updated: 2026-06-04

Severity and scoring

CVSS: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-502

Affected products

Vendor	Product
nvidia	nvtabular

Description

NVIDIA NVTabular contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering and information disclosure.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-24221
[Other]https://nvd.nist.gov/vuln/detail/CVE-2026-24221
[Vendor advisory]https://nvidia.custhelp.com/app/answers/detail/a_id/5851
[Other]https://www.cve.org/CVERecord?id=CVE-2026-24221

Related CVEs

Same vendor

CVE-2026-24237 — NVIDIA NVTabular contains a vulnerability where an attacker could cause improper deserialization of untrusted data (7.8 HIGH)
CVE-2026-24199 — NVIDIA Display Driver for Linux contains a vulnerability in a kernel module, where a user could cause a race condition by reordering comp... (4.7 MEDIUM)
CVE-2026-24197 — NVIDIA Display Driver for Linux contains a vulnerability in the Multi-Instance GPU (MIG) partition management, where an insecure default ... (6.5 MEDIUM)
CVE-2026-24196 — NVIDIA Display Driver for Linux contains a vulnerability where a user could cause an out-of-bounds read (7.1 HIGH)
CVE-2026-24195 — NVIDIA Display Driver for Linux contains a vulnerability in UVM, where a user could cause improper input validation (7.1 HIGH)

Same CWE

CVE-2026-20251 — In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, ... (8.8 HIGH)
CVE-2026-53435 — In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined i... (8.8 HIGH)
CVE-2026-52751 — Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code that allows unauthe... (8.8 HIGH)
CVE-2026-10721 — Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the in Permission, Cache, and Search components
CVE-2026-11815 — An attacker who intercepts and tampers with traffic between the client application and the API Gateway server could potentially deseriali...