CVE-2026-24237 NVIDIA NVTabular Deserialization Remote Code Execution Vulnerability

Technical summary

CVE-2026-24237 is a deserialization vulnerability (CWE-502) in NVIDIA NVTabular that permits improper handling of untrusted serialized objects. The vulnerability requires local access and a valid user account but no additional privilege escalation or user interaction. Once triggered, successful exploitation can result in arbitrary code execution within the privileges of the calling process, enabling both confidentiality and integrity violations. The CVSS 3.1 score of 7.8 reflects the high impact across confidentiality, integrity, and availability combined with the local attack vector and low complexity.

Business impact

Organizations using NVTabular in data science or machine learning pipelines face risk of workload compromise. A malicious insider or lateral movement attacker could weaponize this to exfiltrate training datasets, inject malicious models, or disrupt analytics infrastructure. In regulated environments (financial services, healthcare, automotive), such compromise could trigger compliance incidents, data breach notification obligations, and reputational damage. The local-only attack vector limits blast radius but should not reduce urgency in shared compute environments or cloud deployments where multi-tenant isolation is incomplete.

Affected systems

NVIDIA NVTabular is the sole affected product. Deployments include on-premises data science clusters, Jupyter environments, containerized analytics platforms, and cloud-based ML workflows. Teams using NVTabular for feature engineering, data preprocessing, or exploratory data analysis should inventory their installations and verify patch status. Check both direct usage and transitive dependencies in data pipeline orchestration tools.

Exploitability

Exploitation requires local system access and valid user credentials; remote exploitation is not possible. However, complexity is low—an attacker need only craft a malicious serialized Python object (e.g., pickle payload) and supply it to a vulnerable NVTabular function. In shared development environments, multi-user containers, or lateral-movement scenarios, this becomes practical. The vulnerability does not require user interaction, making it suitable for automated attack chains. No public exploit code or active exploitation has been reported as of the modification date, but the attack surface remains broad given serialization's ubiquity in data processing libraries.

Remediation

Patch NVTabular to the latest version provided by NVIDIA addressing CWE-502. Until patching is feasible, restrict local access to systems running NVTabular, enforce strong authentication and session isolation, and avoid deserializing untrusted data sources. In sandbox or isolated development environments, consider temporary restrictions on untrusted user uploads or data imports. Monitor for suspicious process spawning or anomalous I/O from NVTabular processes.

Patch guidance

Verify the specific patched version through the official NVIDIA NVTabular repository and release notes. Apply patches first to non-production environments and test data pipeline functionality before rolling out broadly. Given the local-only attack vector, patching can be staged by environment sensitivity, but all instances handling untrusted external data should be prioritized. Track patch deployment using your configuration management or vulnerability tracking system.

Detection guidance

Monitor for deserialization-related exceptions or errors in NVTabular logs. Look for unexpected child process creation spawned by Python/NVTabular workers, unusual network connections initiated from data processing nodes, or file writes to unexpected locations. Intrusion detection signatures targeting pickle exploits or similar Python deserialization attacks may yield detection opportunities. In containerized environments, monitor for privilege escalation attempts or container escape indicators. Endpoint detection and response (EDR) tools should flag anomalous behavior in data science workloads.

Why prioritize this

Although not yet on the CISA KEV catalog, this HIGH-severity vulnerability combines code execution capability with local attack vector in widely deployed ML infrastructure. Prioritize if your organization: (1) runs NVTabular in environments with untrusted users or lateral-movement risk; (2) processes sensitive or regulated data through NVTabular pipelines; or (3) operates shared data science platforms. Non-production or low-sensitivity deployments may defer patching slightly longer, but should not remain unpatched indefinitely.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects full impact to confidentiality, integrity, and availability (all rated as H) balanced against a local attack vector and low-privilege attacker requirement. The absence of user interaction and low attack complexity elevate the score despite local-only access. This places it firmly in the patch-soon category for most organizations, though not in the immediate-drop-everything tier reserved for critical remote code execution with no privilege requirement.

Frequently asked questions