# CVE-2026-24262: NVIDIA DGX Spark out-of-bounds write in system firmware

Source: https://junglewise.ai/threats/cve-2026-24262-nvidia-dgx-spark-out-of-bounds-write-in-system-firmware  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-24262 · Severity: high · CVSS 8.2 · Published 2026-08-25

NVIDIA DGX Spark is a high-performance AI computing system used for machine learning and data center workloads. A vulnerability in its system firmware could allow a privileged attacker to corrupt memory, potentially leading to unauthorized code execution, system crashes, or data tampering. This poses a significant risk to organizations relying on DGX Spark for mission-critical AI infrastructure.

Technologies: [Nvidia Dgx Spark](https://junglewise.ai/threats/technologies/dgx-spark), [Nvidia Dgx Spark Uefi](https://junglewise.ai/threats/technologies/dgx-spark-uefi). Vendors: [Nvidia](https://junglewise.ai/threats/vendors/nvidia).

## Quick answers

**Is CVE-2026-24262 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-24262 being exploited in the wild.

**How severe is CVE-2026-24262?** High severity, with a CVSS score of 8.2, published 25 August 2026.

**Which products and versions are affected?** Nvidia Dgx Spark <UNKNOWN>.

**Is there a fix for CVE-2026-24262?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-24262 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-24262?** Check whether you run Nvidia Dgx Spark or Nvidia Dgx Spark Uefi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an out-of-bounds write flaw in NVIDIA DGX Spark's system firmware. It requires an attacker with elevated privileges to exploit. A successful exploit can lead to code execution, privilege escalation, denial of service, information disclosure, and data tampering. The vulnerability affects the firmware component directly, making it a low-level system issue. Patches are expected from NVIDIA as part of their security update cycle.

## Affected products

- NVIDIA DGX Spark <UNKNOWN>

## Timeline

- 2026-08-25: disclosed
- other: Not reported as exploited in the wild as of publication date

## References

- [https://github.com/NVIDIA/product-security/tree/main/2026/5867](https://github.com/NVIDIA/product-security/tree/main/2026/5867)
- [https://www.cve.org/CVERecord?id=CVE-2026-24262](https://www.cve.org/CVERecord?id=CVE-2026-24262)

## Related threats

- [NVIDIA DGX Spark out-of-bounds write in system firmware](https://junglewise.ai/threats/cve-2026-47626-nvidia-dgx-spark-out-of-bounds-write-in-system-firmware)
- [NVIDIA DGX Spark UEFI password bypass](https://junglewise.ai/threats/cve-2026-47624-nvidia-dgx-spark-uefi-password-bypass)
- [NVIDIA DGX Spark NULL pointer dereference in firmware](https://junglewise.ai/threats/cve-2026-24263-nvidia-dgx-spark-null-pointer-dereference-in-firmware)
- [NVIDIA DGX Spark out-of-bounds read in MM firmware](https://junglewise.ai/threats/cve-2026-24225-nvidia-dgx-spark-out-of-bounds-read-in-mm-firmware)