Critical Out-of-Bounds Write in NVIDIA Dynamo Enables Remote Code Execution
Emerging Technology Risk · 3 sources · Updated 3mo ago · First seen Aug 4, 2026
NVIDIA disclosed CVE-2026-24254, a critical out-of-bounds write vulnerability in NVIDIA Dynamo for Linux affecting the multimodal serving topology. The flaw impacts versions 0 through v1.1.0 and carries a CVSS v3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating that it can be exploited remotely without privileges or user interaction.
Successful exploitation could lead to remote code execution, privilege escalation, data tampering, denial of service, and information disclosure. NVIDIA published the issue as part of Security Bulletin 5842, which includes bulletin artifacts and references multiple Dynamo-related CVEs; available metadata indicates no known exploitation so far, while CISA SSVC data flags the bug as automatable with total technical impact.
