NVIDIA vulnerabilities
We track 582 vulnerabilities in NVIDIA products across 60+ products. 582 are rated high or critical, and none are known to be exploited. The most recent was published on October 27, 2026.
Latest NVIDIA vulnerabilities
- 7.8 High severity
BioNeMo Framework: Deserialization of Untrusted Data
NVIDIA BioNemo for Linux contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.
- 7.5 High severity
TensorRT: Out-of-bounds Write
NVIDIA TensorRT contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to data tampering.
- 7.5 High severity
Triton Inference Server: Uncontrolled Resource Consumption
NVIDIA Triton Inference Server contains a vulnerability in the DALI backend, where an attacker could cause uncontrolled resource consumption. A successful exploit of this vulnerability might lead to denial of service.
- 9.8 Critical severity
Triton Inference Server: Integer Overflow or Wraparound
NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an integer overflow. A successful exploit of this vulnerability might lead to code execution, data tampering, or denial of service.
- 9.8 Critical severity
Triton Inference Server: Out-of-bounds Read
NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, or information disclosu
- 7.5 High severity
Triton Inference Server: Integer Overflow or Wraparound
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an integer overflow. A successful exploit of this vulnerability might lead to denial of service.
- 7.5 High severity
Triton Inference Server: Improper Limitation of a Pathname to a Restricted Directory
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issue. A successful exploit of this vulnerability might lead to denial of service.
- 7.5 High severity
Triton Inference Server: Improper Limitation of a Pathname to a Restricted Directory
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issue. A successful exploit of this vulnerability might lead to denial of service.
- 9.8 Critical severity
Triton Inference Server: Authentication Bypass Using an Alternate Path or Channel
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, or information
- 9.8 Critical severity
Triton Inference Server: Authentication Bypass Using an Alternate Path or Channel
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability might lead to escalation of privileges, denial of service, or information disclosure.
- 9.8 Critical severity
TensorRT-LLM: Deserialization of Untrusted Data
NVIDIA TRT-LLM for any platform contains a vulnerability in RPC testing, where an attacker could cause an unsafe deserialization. A successful exploit of this vulnerability might lead to code execution, denial of service, data tampering, and information disclo
- 7.5 High severity
TensorRT-LLM: Unchecked Return Value to NULL Pointer Dereference
NVIDIA TRT-LLM for any platform contains a vulnerability where an attacker could cause an unchecked return value to a null pointer dereference. A successful exploit of this vulnerability might lead to denial of service.
- 9.8 Critical severity
TensorRT-LLM: Deserialization of Untrusted Data
NVIDIA TRT-LLM for any platform contains a deserialization vulnerability and unsafe serialized handle. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- 9.8 Critical severity
TensorRT-LLM: Deserialization of Untrusted Data
NVIDIA TRT-LLM for any platform contains a vulnerability in MPI server, where an attacker could cause an unsafe deserialization. A successful exploit of this vulnerability might lead to code execution, denial of service, data tampering, and information disclos
- 8.6 High severity
NemoClaw: Exposure of Sensitive System Information to an Unauthorized Control Sphere
NVIDIA NeMoClaw contains a vulnerability in the sandbox environment initialization component, where a remote attacker could cause improper access control by sending prompt-injected content that causes the agent to read and exfiltrate host environment variables
- 8.8 High severity
FLARE SDK: Deserialization of Untrusted Data
NVIDIA FLARE SDK contains a vulnerability in FOBS, where an attacker may cause deserialization of untrusted data by sending a malicious FOBS- encoded message. A successful exploit of this vulnerability might lead to code execution.
- 9.8 Critical severity
FLARE SDK: Authorization Bypass Through User-Controlled Key
NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. A successful exploit of this vulnerability may lead to privilege es
- 8.2 High severity
CUDA-Q: Out-of-bounds Read
NVIDIA CUDA-Q contains a vulnerability in an endpoint, where an unauthenticated attacker could cause an out-of-bounds read by sending a maliciously crafted request. A successful exploit of this vulnerability might lead to denial of service and information disc
- 7.7 High severity
KAI Scheduler: Missing Authentication for Critical Functionality
NVIDIA KAI Scheduler contains a vulnerability where an attacker could access API endpoints without authorization. A successful exploit of this vulnerability might lead to information disclosure.
- 7.5 High severity
Triton Inference Server: Uncaught Exception
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request header to the server. A successful exploit of this vulnerability might lead to denial of service.
- 7.5 High severity
Triton Inference Server: Incorrect Conversion between Numeric Types
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request to the server. A successful exploit of this vulnerability might lead to denial of service.
- 7.5 High severity
Triton Inference Server: Integer Overflow or Wraparound
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request to the server. A successful exploit of this vulnerability might lead to denial of service.
- 7.3 High severity
DALI: Deserialization of Untrusted Data
NVIDIA DALI contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to arbitrary code execution.
- 7.5 High severity
Triton Inference Server: Memory Allocation with Excessive Size Value
NVIDIA Triton Inference Server contains a vulnerability where insufficient input validation and a large number of outputs could cause a server crash. A successful exploit of this vulnerability might lead to denial of service.
- 8.8 High severity
BioNeMo Framework: Deserialization of Untrusted Data
NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.
- 9.8 Critical severity
BioNeMo Framework: Deserialization of Untrusted Data
NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.
- 9.4 Critical severity
Jetson Xavier Series and Jetson Orin Series: Initialization of a Resource with an Insecure Default
NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an unprivileged attacker could cause the initialization of a resource with an insecure default. A successful exploit of this vulnerability might lead to information di
- 9.8 Critical severity
NeMo Framework: Deserialization of Untrusted Data
NVIDIA NeMo Framework contains a vulnerability where an attacker may cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure and data tampering.
- 7.5 High severity
Triton Inference Server: Memory Allocation with Excessive Size Value
NVIDIA Triton Inference Server contains a vulnerability in the HTTP endpoint where an attacker may cause a denial of service by providing a large compressed payload. A successful exploit of this vulnerability may lead to denial of service.
- 9.8 Critical severity
NeMo Framework: Deserialization of Untrusted Data
NVIDIA NeMo Framework contains a vulnerability in checkpoint loading where an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure and data tamperi
- 7.8 High severity
Megatron LM: Deserialization of Untrusted Data
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, infor
- 7.8 High severity
Megatron LM: Deserialization of Untrusted Data
NVIDIA Megatron-LM contains a vulnerability in inferencing where an Attacker may cause an RCE by convincing a user to load a maliciously crafted input. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information
- 7.8 High severity
Megatron LM: Deserialization of Untrusted Data
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, infor
- 7.8 High severity
NVIDIA Model Optimizer: Deserialization of Untrusted Data
NVIDIA Model Optimizer for Windows and Linux contains a vulnerability in the ONNX quantization feature, where a user could cause unsafe deserialization by providing a specially crafted input file. A successful exploit of this vulnerability might lead to code e
- 7.5 High severity
Triton Inference Server: Concurrent Execution using Shared Resource with Improper Synchronization
NVIDIA Triton Inference Server contains a vulnerability where an attacker may cause internal state corruption. A successful exploit of this vulnerability may lead to a denial of service.
- 7.8 High severity
Megatron LM: Deserialization of Untrusted Data
NVIDIA Megatron-LM contains a vulnerability in the hybrid conversion script where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation of privile
- 7.8 High severity
Megatron LM: Deserialization of Untrusted Data
NVIDIA Megatron LM contains a vulnerability in quantization configuration loading, which could allow remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tamp
- 9.0 Critical severity
Apex: Deserialization of Untrusted Data
NVIDIA APEX for Linux contains a vulnerability where an unauthorized attacker could cause a deserialization of untrusted data. This vulnerability affects environments that use PyTorch versions earlier than 2.6. A successful exploit of this vulnerability might
- 7.5 High severity
Triton Inference Server: Concurrent Execution using Shared Resource with Improper Synchronization
NVIDIA Triton Inference Server Sagemaker HTTP server contains a vulnerability where an attacker may cause an exception. A successful exploit of this vulnerability may lead to denial of service.
- 7.5 High severity
DLS component of NVIDIA License System: Improper Authentication
NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an attacker could exploit an improper authentication issue. A successful exploit of this vulnerability might lead to information disclosure.