CVE-2026-24148

CriticalCVSS 9.4/10Last modified Jul 24, 2026

Description

NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an unprivileged attacker could cause the initialization of a resource with an insecure default. A successful exploit of this vulnerability might lead to information disclosure of encrypted data, data tampering, and partial denial of service across devices sharing the same machine ID.

Metrics

CVSS 3.1 9.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-1188

Affected software

VendorProductVersions
NVIDIAJetson Xavier Series and Jetson Orin SeriesAll versions prior to 35.6.4
NVIDIAJetson Xavier Series and Jetson Orin SeriesAll versions prior to 36.5

References

Timeline

Published
Mar 31, 2026
Last modified
Jul 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-241497.8NVIDIA Megatron-LM for all platforms contains a vulnerability in a script, where malicious data created by an attacker may cause a code injeCVE-2026-24155.9Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email templatCVE-2026-241507.8NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciouCVE-2026-241517.8NVIDIA Megatron-LM contains a vulnerability in inferencing where an Attacker may cause an RCE by convincing a user to load a maliciously craCVE-2026-241527.8NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciouCVE-2026-241535.5NVIDIA Jetson Linux has a vulnerability in initrd, where the nvluks trusted application is not disabled. A successful exploit of this vulnerCVE-2026-241546.8NVIDIA Jetson Linux has vulnerability in initrd, where an unprivileged attacker with physical access coul inject incorrect command line arguCVE-2026-241557.8NVIDIA NeMo Framework for all platforms contains a code injection vulnerability. A successful exploit of this vulnerability might lead to coCVE-2026-241567.3NVIDIA DALI contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulneraCVE-2026-241579.8NVIDIA NeMo Framework contains a vulnerability in checkpoint loading where an attacker could cause remote code execution. A successful exploCVE-2026-241587.5NVIDIA Triton Inference Server contains a vulnerability in the HTTP endpoint where an attacker may cause a denial of service by providing a CVE-2026-241599.8NVIDIA NeMo Framework contains a vulnerability where an attacker may cause remote code execution. A successful exploit of this vulnerability
CVE-2026-24148: Critical severity, CVSS 9.4 | Vulnix