Executive brief
NVIDIA Transformers4Rec, a library used for building recommendation systems with deep learning, contains a security flaw in how it processes data. An attacker could exploit this to run unauthorized code, tamper with data, or access sensitive information. This could lead to a compromise of the recommendation engine's integrity and the underlying server.
Technical details
A deserialization vulnerability (CWE-502) exists in NVIDIA Transformers4Rec due to the improper handling of untrusted data during the deserialization process. An attacker with local access could provide a specially crafted input that, when processed by the library, triggers the execution of arbitrary code or results in unauthorized data modification and information disclosure. The vulnerability is tracked under CVE-2026-24232 and affects Linux platforms. A fix has been identified in the codebase associated with commit 41b14d7.
Affected products
- NVIDIA Transformers4Rec versions prior to commit 41b14d7
Timeline
- 2026-07-21: advisory: NVIDIA published the security bulletin and NVD record.
- 2026-07-21: disclosed