Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

NVIDIA NeMo Speech allows remote code execution

CVE-2026-24267 · published 1 month ago
Summary

The speech data explorer feature in NVIDIA NeMo Speech can be tricked with specially crafted audio files, letting an attacker run code on the server. This could let them take control, view confidential information, or alter data. Apply any available updates from NVIDIA and avoid processing untrusted audio files until the fix is installed.

What to do
  • Update nvidia nemo_speech to version 3.0.0 or later.
Affected software
VendorProductAffected versions
nvidia nemo speech 0.0 to 2.9
nvidia nemo_speech < 3.0.0
cpe:2.3:a:nvidia:nemo_speech:*:*:*:*:*:*:*:*
Original advisory text
NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data explorer component, where malicious data created by an attacker could cause remote code execution. A successful expl...
NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data explorer component, where malicious data created by an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published22 Sep 2026
Updated4 Nov 2026
First seen22 Sep 2026
Sources
CVE-2026-24267 · NVD
CVE-2026-24267 · MITRE
CVE-2026-24267 · OSV
Track software like this
Free during beta