ZDI-CAN-28677: ZDI-26-410: NVIDIA NeMo Framework Deserialization of Untrusted Data Remote Code Execution Vulnerability

Published Jul 15, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA NeMo Framework. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-24228.

Affected Software

1 affected component

Nvidia NeMo framework

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade NVIDIA NeMo Framework to a version that resolves this vulnerability.
Patch ZDI-26-410

Event History

Jul 15, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-28677?

ZDI-CAN-28677 has a CVSS rating of 7.8, indicating high severity.

How do I fix ZDI-CAN-28677?

To address ZDI-CAN-28677, update NVIDIA NeMo Framework to the latest version provided by the vendor.

What type of vulnerability is ZDI-CAN-28677?

ZDI-CAN-28677 is a remote code execution vulnerability caused by deserialization of untrusted data.

What systems are affected by ZDI-CAN-28677?

ZDI-CAN-28677 affects installations of NVIDIA NeMo Framework that are not updated.

What is required for an attacker to exploit ZDI-CAN-28677?

User interaction is required, as the target must visit a malicious page or open a malicious file for the exploit.