Is CVE-2026-24156 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-24156 being exploited in the wild.

How severe is CVE-2026-24156?

High severity, with a CVSS score of 7.3, published 7 April 2026.

Which products and versions are affected?

Nvidia DALI All versions prior to 2.0.0.

Is there a fix for CVE-2026-24156?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-24156 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-24156?

Check whether you run Nvidia DALI or Nvidia Data Loading Library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-24156: NVIDIA DALI deserialization of untrusted data

CVE-2026-24156 · Severity: high · CVSS 7.3 · Published 2026-04-07

NVIDIA DALI, a library used to accelerate data loading for deep learning applications, contains a security flaw in how it processes data. An attacker could use this vulnerability to execute unauthorized commands on a system where the library is installed. This could lead to a complete compromise of the affected machine, potentially exposing sensitive AI models or training data.

Technologies: Nvidia DALI. Vendors: Nvidia.

Quick answers

Is CVE-2026-24156 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-24156 being exploited in the wild.
How severe is CVE-2026-24156?: High severity, with a CVSS score of 7.3, published 7 April 2026.
Which products and versions are affected?: Nvidia DALI All versions prior to 2.0.0.
Is there a fix for CVE-2026-24156?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-24156 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-24156?: Check whether you run Nvidia DALI or Nvidia Data Loading Library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A deserialization of untrusted data vulnerability (CWE-502) exists in NVIDIA DALI versions prior to 2.0.0. The flaw allows a local attacker with low privileges to execute arbitrary code by tricking a user into processing a specially crafted file. The attack vector is local (AV:L) and requires user interaction (UI:R). Successful exploitation results in high impact to confidentiality, integrity, and availability. The issue is addressed in NVIDIA DALI version 2.0.0.

Affected products

NVIDIA DALI (Data Loading Library) All versions prior to 2.0.0

Timeline

2026-04-07: disclosed
2026-04-07: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.