CVE-2026-24152
Remote Code Execution in NVIDIA Megatron-LM Checkpoint Loading
Publication date: 2026-03-24
Last updated on: 2026-03-25
Assigner: NVIDIA Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nvidia | megatron-lm | to 0.15.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-24152 is a vulnerability in NVIDIA Megatron-LM related to checkpoint loading.
An attacker can exploit this flaw by persuading a user to load a maliciously crafted checkpoint file, which may result in remote code execution (RCE).
Successful exploitation can lead to code execution, privilege escalation, information disclosure, and data tampering.
This vulnerability is classified under CWE-502: Deserialization of Untrusted Data.
How can this vulnerability impact me? :
Exploiting this vulnerability can have severe impacts including remote code execution, which allows an attacker to run arbitrary code on the affected system.
It can also lead to escalation of privileges, enabling attackers to gain higher access rights than initially permitted.
Additionally, it may cause information disclosure, exposing sensitive data, and data tampering, compromising the integrity of data.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The vulnerability in NVIDIA Megatron-LM arises from loading maliciously crafted checkpoint files which can lead to remote code execution and other severe impacts.
To mitigate this vulnerability, avoid loading checkpoint files from untrusted or unknown sources.
Ensure that only trusted users with appropriate privileges have access to load checkpoint files.
Monitor for updates or patches from NVIDIA and apply them promptly once available.