ZDI-CAN-28536: ZDI-26-564: NVIDIA Transformers4Rec load_model_trainer_states_from_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability

Published Aug 13, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA Transformers4Rec. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-24232.

Affected Software

1 affected component

Nvidia Transformers4Rec

Event History

Aug 13, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-28536?

The severity of ZDI-CAN-28536 is rated at 7.8 on the CVSS scale.

How do I fix ZDI-CAN-28536?

To fix ZDI-CAN-28536, ensure that you update the NVIDIA Transformers4Rec software to the latest version provided by NVIDIA.

What is the impact of ZDI-CAN-28536?

The impact of ZDI-CAN-28536 allows remote attackers to execute arbitrary code on affected installations.

What software is affected by ZDI-CAN-28536?

ZDI-CAN-28536 affects NVIDIA Transformers4Rec installations.

Is user interaction required to exploit ZDI-CAN-28536?

Yes, user interaction is required for ZDI-CAN-28536 as the target must visit a malicious page or open a malicious file.