CVE-2026-24149CWE-94

NVIDIA Megatron-LM for all platforms contains a vulnerability in a script, where malicious data created by an attacker may cause a code injection issue

High · published February 3, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
20.5
In the wild
Unconfirmed
What it is

⚡ A crafty script in NVIDIA Megatron-LM has left the door open for an attacker to slip in malicious code without breaking a sweat! 🔥 Think of it like a restaurant that lets customers tamper with the menu before the chef even sees it – if the kitchen isn’t careful, someone could sneak in a dangerous dish that spoils the whole meal. An attacker could exploit this vulnerability to execute arbitrary code, leading to a catastrophic scenario where they gain elevated privileges, disclose sensitive information, or even tamper with data at will. Imagine your secret recipe suddenly being shared with competitors or worse, altered!

Put simply

Think of it like a restaurant that lets customers tamper with the menu before the chef even sees it – if the kitchen isn’t careful, someone could sneak in a dangerous dish that spoils the whole meal. This issue arises from a code injection vulnerability in the script used by NVIDIA Megatron-LM, allowing attackers to introduce harmful data that could then execute unauthorized commands within the system.

What to do

An attacker could exploit this vulnerability to execute arbitrary code, leading to a catastrophic scenario where they gain elevated privileges, disclose sensitive information, or even tamper with data at will. Imagine your secret recipe suddenly being shared with competitors or worse, altered! To secure your environment, update to the latest version of NVIDIA Megatron-LM as soon as it’s available. Review your scripts for any potential vulnerabilities and implement input validation to avoid accepting untrusted data. Keep an eye on updates and advisories from NVIDIA to stay on top of security measures. You've got this! Stay proactive, and you'll keep your systems safe and sound! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00290 · 20.5th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-02-03T19:55Z
EPSS history
Timeline
  • 03 FEB 19:55Z
    NVIDIA Megatron-LM for all platforms contains a vulnerability in a script, where malicious data created by an attacker may cause a code injection issue
    cvelistv5