NVIDIA DALI Vulnerabilities Cause Remote Service Disruption

EXECUTIVE SUMMARY:

Multiple security vulnerabilities have been identified in NVIDIA DALI, an accelerated data loading library used for AI and machine learning workloads, affecting versions 0.0 through 2.0. The flaws consist of a heap‑based buffer overflow and improper index validation, both of which can be leveraged to achieve remote code execution, data tampering, denial‑of‑service, and information disclosure. Because the library operates across Windows, Linux, and macOS platforms, attackers can bypass operating‑system protections and gain full control of the host environment. Exploitation could disrupt critical AI pipelines, expose sensitive training data, and cause costly downtime for enterprises that rely on the affected software.[emaillocker id="1283"]

• CVE-2026-24180 with a CVSS score of 7.3 – It is a heap‑based buffer overflow in NVIDIA DALI that allows an attacker to write beyond allocated memory, leading to arbitrary code execution; exploitation requires only network access to a vulnerable DALI instance.
• CVE-2026-24181 – It involves improper index validation in the same library, enabling crafted inputs to corrupt memory structures and trigger denial‑of‑service or potential code execution; no specific CVSS score was disclosed.

These vulnerabilities present a high‑severity risk to any organization deploying NVIDIA DALI in production, as attackers can gain unrestricted access to AI workloads and underlying infrastructure. Immediate attention is required because exploitation could result in service outages, loss of proprietary data, and reputational damage.

RECOMMENDATION:

• We recommend you to update NVIDIA DALI to version v2.1.

REFERENCES:

The following reports contain further technical details:
https://securityonline.info/nvidia-dali-vulnerabilities/