Executive Summary

CVE-2026-24141 is a high-severity vulnerability in the NVIDIA Model Optimizer for Windows and Linux, specifically in the ONNX quantization feature.

The vulnerability arises from unsafe deserialization triggered by a specially crafted input file, which can be exploited by an attacker.

This unsafe deserialization is classified under CWE-502 (Deserialization of Untrusted Data).

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can lead to remote code execution, allowing an attacker to run arbitrary code on the affected system.

It can also result in escalation of privileges, enabling attackers to gain higher access rights than intended.

Additionally, the vulnerability can cause data tampering and information disclosure, compromising the confidentiality, integrity, and availability of data.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the vulnerability in NVIDIA Model Optimizer affecting the ONNX quantization feature, users should update to ModelOpt version 0.41.0 or later.

This update addresses the unsafe deserialization issue that could lead to code execution, privilege escalation, data tampering, and information disclosure.

Users are advised to clone or update the software from NVIDIA’s official GitHub repository to ensure they have the patched version.

Additionally, evaluating the risk based on specific system configurations and following NVIDIA’s ongoing security bulletins and support is recommended.

Useful 0 Not Useful 0