NVIDIA NeMo Framework contains an RCE vulnerability in checkpoint loading

CRITICAL 9.8CVE-2026-24157 · GHSA-m4jw-wgmf-889x · PYSEC-2026-2674 · Published 24/03/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
nemo-toolkit PyPI	`< 2.6.2`	`2.6.2`
nemo nvidia	`< 2.6.2`	`2.6.2`

Description

NVIDIA NeMo Framework contains a vulnerability in checkpoint loading where an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure and data tampering.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2026-24157 · ADVISORY
NVIDIA-NeMo/NeMo · PACKAGE
nvidia.custhelp.com/app/answers/detail/a_id/5800 · WEB
cve.org/CVERecord · WEB
pypi.org/project/nemo-toolkit · PACKAGE
GitHub Advisory GHSA-m4jw-wgmf-889x · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free