# CVE-2026-24156: NVIDIA DALI deserialization of untrusted data

Source: https://junglewise.ai/threats/cve-2026-24156-nvidia-dali-deserialization-of-untrusted-data  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-24156 · Severity: high · CVSS 7.3 · Published 2026-04-07

NVIDIA DALI, a library used to accelerate data loading for deep learning applications, contains a security flaw in how it processes data. An attacker could use this vulnerability to execute unauthorized commands on a system where the library is installed. This could lead to a complete compromise of the affected machine, potentially exposing sensitive AI models or training data.

Technologies: [Nvidia DALI](https://junglewise.ai/threats/technologies/dali). Vendors: [Nvidia](https://junglewise.ai/threats/vendors/nvidia).

## Quick answers

**Is CVE-2026-24156 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-24156 being exploited in the wild.

**How severe is CVE-2026-24156?** High severity, with a CVSS score of 7.3, published 7 April 2026.

**Which products and versions are affected?** Nvidia DALI All versions prior to 2.0.0.

**Is there a fix for CVE-2026-24156?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-24156 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-24156?** Check whether you run Nvidia DALI or Nvidia Data Loading Library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A deserialization of untrusted data vulnerability (CWE-502) exists in NVIDIA DALI versions prior to 2.0.0. The flaw allows a local attacker with low privileges to execute arbitrary code by tricking a user into processing a specially crafted file. The attack vector is local (AV:L) and requires user interaction (UI:R). Successful exploitation results in high impact to confidentiality, integrity, and availability. The issue is addressed in NVIDIA DALI version 2.0.0.

## Affected products

- NVIDIA DALI (Data Loading Library) All versions prior to 2.0.0

## Timeline

- 2026-04-07: disclosed
- 2026-04-07: advisory

## References

- [https://nvidia.custhelp.com/app/answers/detail/a_id/5811](https://nvidia.custhelp.com/app/answers/detail/a_id/5811)
- [https://www.cve.org/CVERecord?id=CVE-2026-24156](https://www.cve.org/CVERecord?id=CVE-2026-24156)

## Related threats

- [NVIDIA DALI out-of-bounds read](https://junglewise.ai/threats/cve-2026-65150-nvidia-dali-contains-a-vulnerability-where-an-attacker-could)
- [NVIDIA DALI out-of-bounds write vulnerability](https://junglewise.ai/threats/cve-2026-65149-nvidia-dali-contains-a-vulnerability-where-an-attacker-could)
- [NVIDIA DALI stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-65148-nvidia-dali-contains-a-vulnerability-where-an-attacker-could)
- [NVIDIA DALI out-of-bounds read](https://junglewise.ai/threats/cve-2026-65147-nvidia-dali-contains-a-vulnerability-where-an-attacker-could)
- [NVIDIA DALI improper index validation](https://junglewise.ai/threats/cve-2026-24181-nvidia-dali-improper-index-validation)