CVE-2026-24152 affects NVIDIA Megatron-LM, where a vulnerability in checkpoint loading allows an attacker to achieve remote code execution by convincing a user to load a maliciously crafted file. This high-severity issue (CVSS 7.8) requires user interaction and local access, but successful exploitation can lead to code execution, privilege escalation, information disclosure, and data tampering. The attack vector is local with user interaction required, and its complexity is low. Currently, there is no public exploit code available (Metasploit, Nuclei, ExploitDB), and it is not listed in the CISA KEV catalog or on the Hot List. Community discussion is minimal, with only two mentions across social platforms, indicating a low level of active exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 0.15.3CPE matchmatch criteria | cpe:2.3:a:nvidia:megatron-lm:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.