Cyber Posture

CVE-2026-24164

High

Published: 31 March 2026

Published
31 March 2026
Modified
03 April 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0011 28.6th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Flaw remediation directly mitigates this deserialization vulnerability by applying vendor patches to prevent exploitation.

SI-10 Information Input Validation good match
prevent

Information input validation prevents deserialization of untrusted data by checking and rejecting malformed or malicious inputs.

SI-16 Memory Protection partial match
prevent

Memory protection mechanisms like non-executable memory and ASLR mitigate arbitrary code execution resulting from deserialization exploits.

Security SummaryAI

CVE-2026-24164 is a vulnerability in NVIDIA BioNeMo that enables deserialization of untrusted data, corresponding to CWE-502: Deserialization of Untrusted Data. Published on 2026-03-31, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability.

The vulnerability can be exploited by any unauthenticated attacker over the network with low complexity, though it requires user interaction to trigger. A successful attack might result in arbitrary code execution, denial of service, information disclosure, or data tampering on the affected system.

Mitigation guidance and additional details are available in official advisories, including the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-24164, NVIDIA's security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5808, and the CVE record at https://www.cve.org/CVERecord?id=CVE-2026-24164.

Details

CWE(s)
CWE-502

Affected Products

nvidia
bionemo framework
≤ 2026-01-21

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Deserialization of untrusted data vulnerability in network-accessible NVIDIA BioNeMo service (AV:N/PR:N) enables unauthenticated remote code execution with user interaction, directly facilitating T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References