CVE-2026-24149
Code Injection Vulnerability in NVIDIA Megatron-LM Script
Publication date: 2026-02-03
Last updated on: 2026-02-03
Assigner: NVIDIA Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nvidia | megatron-lm | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-24149 is a vulnerability in NVIDIA Megatron-LM across all platforms involving a script that processes maliciously crafted data from an attacker.
This vulnerability leads to a code injection issue, which means an attacker can insert and execute arbitrary code within the affected system.
How can this vulnerability impact me? :
Exploitation of this vulnerability can result in arbitrary code execution, allowing attackers to run malicious code on the system.
It can also lead to escalation of privileges, meaning attackers can gain higher access rights than originally permitted.
Additionally, it may cause information disclosure, exposing sensitive data to unauthorized parties.
Data tampering is another possible impact, where attackers can alter or corrupt data.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in NVIDIA Megatron-LM allows for code injection that can lead to arbitrary code execution, privilege escalation, information disclosure, and data tampering.
Such impacts—especially information disclosure and data tampering—can negatively affect compliance with common standards and regulations like GDPR and HIPAA, which require protection of data confidentiality, integrity, and availability.
However, no specific information about compliance implications or regulatory impact is provided in the available resources.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know