CVE-2026-65104

HighCVSS 7.1/10Last modified Oct 13, 2026

Description

NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker could cause hash collisions in the cache used for inference requests. A successful exploit of this vulnerability might lead to data tampering and partial information disclosure.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N

Weakness enumeration

CWE-328

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
NVIDIAMegatron-LM0 to 17

References

Timeline

Published
Oct 13, 2026
Last modified
Oct 13, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-651058.1NVIDIA NemoClaw for Linux contains a vulnerability in its inference server setup, where a remote attacker may access the inference service wCVE-2026-651076.3NVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as part of an sbcast file transmission to write aCVE-2026-651086.3NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is running with root CVE-2026-651094.7NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside of CVE-2026-65115.5During an internal security assessment, a potential improper access control vulnerability was discovered in Lenovo Smart Connect for WindowsCVE-2026-651107.8NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a malicCVE-2026-651117.8NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious input created by an attacker could cause a code injection. A sCVE-2026-651126.5NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause uncontrolled resource consumption. A succeCVE-2026-651139.8NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of hard-coded credentials. A successfuCVE-2026-651149.8NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause missing authentication for a critical funcCVE-2026-651156.5NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker may cause uncontrolled resource consumption. A successCVE-2026-651178.8NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of a hard-coded password. A successful
CVE-2026-65104: High severity, CVSS 7.1 | Vulnix