Loading vulnerability…
Out-of-Bounds Write in NVIDIA Dynamo Multimodal Serving Topology
CVE-2026-24254 is an out-of-bounds write vulnerability in the multimodal serving topology of NVIDIA Dynamo for Linux. NVIDIA Dynamo versions through 1.1.0 are affected. An attacker can trigger an out-of-bounds memory write, potentially corrupting process memory and enabling impacts including code execution, privilege escalation, data tampering, denial of service, and information disclosure.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise confidentiality, integrity, and availability. The stated potential effects include arbitrary code execution, privilege escalation, modification of data, service disruption, and disclosure of sensitive information. The assigned CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with a 9.8 Critical base score.
If you can’t patch tonight, do this now.
Until upgraded, limit network access to NVIDIA Dynamo instances, restrict access to multimodal serving functionality to trusted clients, apply network segmentation and authentication controls, and evaluate exposure based on the deployed Dynamo configuration. Obtain and maintain Dynamo releases through the official NVIDIA project distribution channel.
Patch, then assume compromise.
Upgrade NVIDIA Dynamo for Linux to version 1.1.1 or a later fixed release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.