CVE-2026-24141

NVIDIA Model Optimizer for Windows and Linux contains a vulnerability in the ONNX quantization feature, where a user could cause unsafe deserialization by providing a specially crafted input file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://nvd.nist.gov/vuln/detail/CVE-2026-24141
https://nvidia.custhelp.com/app/answers/detail/a_id/5798
https://www.cve.org/CVERecord?id=CVE-2026-24141

Configurations

No configuration.

History

17 Jun 2026, 10:22

Type	Values Removed	Values Added
Summary		(es) NVIDIA Model Optimizer para Windows y Linux contiene una vulnerabilidad en la característica de cuantificación ONNX, donde un usuario podría causar una deserialización insegura al proporcionar un archivo de entrada especialmente diseñado. Un exploit exitoso de esta vulnerabilidad podría conducir a la ejecución de código, escalada de privilegios, manipulación de datos y revelación de información.

24 Mar 2026, 21:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-24 21:16

Updated : 2026-06-17 10:22

NVD link : CVE-2026-24141

Mitre link : CVE-2026-24141

CVE.ORG link : CVE-2026-24141

JSON object : View

Products Affected

No product.

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-24141", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24141", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-03-25T14:24:25.297719Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@nvidia.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "psirt@nvidia.com", "affectedData": [{"vendor": "NVIDIA", "product": "NVIDIA Model Optimizer", "versions": [{"status": "affected", "version": "All versions prior to 0.41.0"}], "platforms": ["All"], "defaultStatus": "unaffected"}]}], "published": "2026-03-24T21:16:27.203", "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24141", "source": "psirt@nvidia.com"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5798", "source": "psirt@nvidia.com"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-24141", "source": "psirt@nvidia.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "psirt@nvidia.com", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "NVIDIA Model Optimizer for Windows and Linux contains a vulnerability in the ONNX quantization feature, where a user could cause unsafe deserialization by providing a specially crafted input file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure."}, {"lang": "es", "value": "NVIDIA Model Optimizer para Windows y Linux contiene una vulnerabilidad en la caracter\u00edstica de cuantificaci\u00f3n ONNX, donde un usuario podr\u00eda causar una deserializaci\u00f3n insegura al proporcionar un archivo de entrada especialmente dise\u00f1ado. Un exploit exitoso de esta vulnerabilidad podr\u00eda conducir a la ejecuci\u00f3n de c\u00f3digo, escalada de privilegios, manipulaci\u00f3n de datos y revelaci\u00f3n de informaci\u00f3n."}], "lastModified": "2026-06-17T10:22:42.033", "sourceIdentifier": "psirt@nvidia.com"}