CVE-2026-24267
NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data explorer component, where malicious data created by an attacker could cause remote code execution.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.61%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data explorer component, where malicious data created by an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 0.61% probability · 49th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-502
- Affected
- nvidia/nemo speech
- Source
- psirt@nvidia.com
EPSS moved from 0.6% on 23 September 2026 to 0.6% on 27 October 2026.
References
- https://github.com/NVIDIA/product-security/tree/main/2026/5885Patch
- https://nvd.nist.gov/vuln/detail/CVE-2026-24267US Government Resource
- https://www.cve.org/CVERecord?id=CVE-2026-24267Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.