NVIDIA Megatron Bridge YAML parsing bug enables code execution
Original title: ZDI-26-787: NVIDIA Megatron Bridge YAML File Parsing Code Injection Remote Code Execution Vulnerability
CVE-2026-24250 requires a user to open a malicious file or page; ZDI rates it CVSS 7.8.
ZDI-26-787 covers a code-injection flaw in YAML file parsing in NVIDIA Megatron Bridge. Remote attackers can run arbitrary code if a user visits a malicious page or opens a malicious file. ZDI assigned CVSS 7.8 and CVE-2026-24250. Versions and patches are not stated.
Unconfirmed: Affected versions and any fix are not stated.
- User interaction is required for exploitation.
- The trigger is a malicious page or file.
- ZDI's CVSS rating is 7.8.
- The advisory ID is ZDI-26-787.
Impact: remote code execution after opening a file
| Product | Affected |
|---|---|
| NVIDIA Megatron Bridge | — |
- CVEs
- CVE-2026-24250
- Vendors
- NVIDIA
- Products
- Megatron Bridge
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-24250 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper validation of allowed inputs | 7.8 | <1% |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA Megatron Bridge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.