Search: “ZDI”

36 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 295 Exploit / PoC 100 Advisory 76 Ransomware 19 Malware 7 Industry 5 Threat actor 5 Data breach 2 Phishing & fraud 1 Research 1 Policy & legal 1

SeverityAll critical 258 high 75 medium 132 low 47 info 0

ZDI-26-644: Oracle VirtualBox VMSVGA Race Condition Local Privilege Escalation Vulnerability

ZDI publishes ZDI-26-644 for CVE-2026-60155, a race condition local privilege escalation in Oracle VirtualBox VMSVGA, rated CVSS 7.5.

Zero Day Initiative published advisory ZDI-26-644 describing a race condition in Oracle VirtualBox's VMSVGA component. Local attackers who already execute high-privileged code on the guest system can escalate privileges on affected installations. ZDI rated the issue CVSS 7.5 and assigned CVE-2026-60155.

ZDI Published AdvisoriesSep 9, 05:00 UTC · 7d agoAdvisory 6 sources CVE-2026-60155

ZDI-26-646: Progress Software Kemp LoadMaster escape_quotes Uninitialized Memory Remote Code Execution Vulnerability

ZDI publishes ZDI-26-646 for CVE-2026-8037, an authenticated uninitialized-memory remote code execution flaw in Progress Kemp LoadMaster, rated CVSS 7.2.

Zero Day Initiative published advisory ZDI-26-646 describing an uninitialized memory flaw in Progress Software Kemp LoadMaster's escape_quotes function. Successful exploitation allows remote authenticated attackers to execute arbitrary code on affected installations. ZDI rated the issue CVSS 7.2 and assigned CVE-2026-8037.

ZDI Published AdvisoriesSep 9, 05:00 UTC · 7d agoAdvisory CVE-2026-8037

ZDI-26-645: Fortinet FortiSandbox write_remote_backup_to_crontab cronValue Command Injection Remote Code Execution Vulnerability

ZDI publishes ZDI-26-645 for CVE-2026-84387, an authenticated command injection RCE in Fortinet FortiSandbox via crontab backup, rated CVSS 7.2.

Zero Day Initiative published advisory ZDI-26-645 describing a command injection flaw in Fortinet FortiSandbox's write_remote_backup_to_crontab function. Remote authenticated attackers can execute arbitrary code through the cronValue parameter. ZDI rated the issue CVSS 7.2 and assigned CVE-2026-84387.

ZDI Published AdvisoriesSep 9, 05:00 UTC · 7d agoAdvisory CVE-2026-84387

ZDI-26-614: (0Day) pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI published ZDI-26-614, another unpatched out-of-bounds write in pdfforge PDF Architect PDF parsing enabling remote code execution (CVSS 7.8).

The Zero Day Initiative published ZDI-26-614, a second out-of-bounds write vulnerability in pdfforge PDF Architect's PDF file parsing. Attackers can execute arbitrary code on affected installations, provided the user visits a malicious page or opens a malicious file. The flaw carries a ZDI-assigned CVSS score of 7.8 and remains unpatched (0day).

ZDI Published AdvisoriesAug 31, 05:00 UTC · 16d agoAdvisory

ZDI-26-611: (0Day) pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability

ZDI published ZDI-26-611, an unpatched out-of-bounds read in pdfforge PDF Architect App Object enabling remote code execution (CVSS 7.8).

The Zero Day Initiative disclosed ZDI-26-611, an out-of-bounds read vulnerability in the App Object component of pdfforge PDF Architect that can lead to remote code execution. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. ZDI rated the issue 7.8 on the CVSS scale and marks it as a 0day pending a vendor patch.

ZDI Published AdvisoriesAug 31, 05:00 UTC · 16d agoAdvisory

ZDI-26-613: (0Day) pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution Vulnerability

ZDI published ZDI-26-613, an unpatched memory corruption flaw in pdfforge PDF Architect PDF parsing enabling remote code execution (CVSS 7.8).

The Zero Day Initiative disclosed ZDI-26-613, a memory corruption vulnerability in pdfforge PDF Architect's PDF file parsing that allows remote code execution on affected installations. User interaction is required, meaning the target must visit a malicious page or open a malicious file. ZDI assigned a CVSS score of 7.8 and classifies the issue as a 0day.

ZDI Published AdvisoriesAug 31, 05:00 UTC · 16d agoAdvisory

ZDI-26-612: (0Day) pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI published ZDI-26-612, an unpatched out-of-bounds write in pdfforge PDF Architect PDF parsing enabling remote code execution (CVSS 7.8).

The Zero Day Initiative disclosed ZDI-26-612, an out-of-bounds write vulnerability in pdfforge PDF Architect's PDF file parsing. Successful exploitation allows remote code execution on affected installations. User interaction is required, as the target must visit a malicious page or open a malicious file; ZDI assigned a CVSS score of 7.8 and lists the flaw as a 0day.

ZDI Published AdvisoriesAug 31, 05:00 UTC · 16d agoAdvisory

ZDI-26-586: OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability

ZDI advisory ZDI-26-586 reports a memory corruption RCE (CVE-2026-19886, CVSS 7.8) in OriginLab Origin Viewer OGM file parsing, needing user interaction.

The Zero Day Initiative published advisory ZDI-26-586 describing a memory corruption vulnerability in OriginLab Origin Viewer's OGM file parsing. Exploitation allows remote code execution when a user opens a malicious file or visits a crafted page. ZDI rated the issue CVSS 7.8 and assigned CVE-2026-19886.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoAdvisory CVE-2026-19886

ZDI-26-587: Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI advisory ZDI-26-587 details a heap-based buffer overflow RCE (CVE-2026-19781, CVSS 7.8) in Ashlar-Vellum Cobalt VS file parsing, requiring user interaction.

The Zero Day Initiative released advisory ZDI-26-587 covering a heap-based buffer overflow in Ashlar-Vellum Cobalt's VS file parsing. A remote attacker can execute arbitrary code when the target opens a malicious file or visits a crafted page. ZDI rated the vulnerability CVSS 7.8 and assigned CVE-2026-19781.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoAdvisory CVE-2026-19781

ZDI-26-686: Linux Kernel nftables Race Condition Local Privilege Escalation Vulnerability

ZDI discloses CVE-2026-74565, a CVSS 7.8 nftables race condition letting local low-privileged attackers escalate privileges on Linux.

ZDI-26-686 describes a race condition in the Linux Kernel nftables subsystem that allows local attackers to escalate privileges. Exploitation requires the ability to execute low-privileged code on the target system. ZDI assigned a CVSS rating of 7.8 and CVE-2026-74565.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoAdvisory CVE-2026-74565

ZDI-26-683: Linux Kernel IPv6 VTI Subsystem Use-After-Free Local Privilege Escalation Vulnerability

ZDI discloses CVE-2026-72463, a CVSS 7.5 use-after-free in the Linux Kernel IPv6 VTI subsystem enabling privilege escalation.

ZDI-26-683 covers a use-after-free in the Linux Kernel IPv6 VTI subsystem that allows local attackers to escalate privileges. Exploitation requires first obtaining the ability to execute high-privileged code on the target system, limiting practical impact. ZDI assigned a CVSS rating of 7.5 and CVE-2026-72463.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoAdvisory CVE-2026-72463

ZDI-26-681: Linux Kernel FUSE Subsystem Race Condition Local Privilege Escalation Vulnerability

ZDI discloses CVE-2026-64265, a CVSS 7.8 race condition in the Linux Kernel FUSE subsystem enabling local privilege escalation.

ZDI-26-681 covers a race condition in the Linux Kernel FUSE subsystem that allows local attackers to escalate privileges. Exploitation requires the ability to execute low-privileged code on the target system. ZDI assigned a CVSS rating of 7.8 and CVE-2026-64265.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoAdvisory CVE-2026-64265

ZDI-26-655: PAPPL Printer IPP Processing Stack-based Buffer Overflow Local Privilege Escalation Vulnerability

ZDI-26-655: Stack-based buffer overflow in PAPPL printer IPP processing enables local privilege escalation, rated CVSS 7.8.

The Zero Day Initiative published advisory ZDI-26-655 for PAPPL. A stack-based buffer overflow in printer IPP processing allows local attackers to escalate privileges after obtaining low-privileged code execution. ZDI assigned a CVSS 7.8 rating. No CVE identifier was listed in the advisory text.

ZDI Published AdvisoriesSep 10, 05:00 UTC · 6d agoAdvisory 2 sources1

ZDI-26-654: TrendAI Apex One Incomplete Cleanup Local Privilege Escalation Vulnerability

ZDI-26-654: Trend Micro Apex One incomplete cleanup flaw, CVE-2025-71414, enables local privilege escalation, rated CVSS 7.8.

The Zero Day Initiative published advisory ZDI-26-654 for the Trend Micro Apex One Security Agent. An incomplete cleanup flaw, tracked as CVE-2025-71414, allows local attackers to escalate privileges after gaining low-privileged code execution. ZDI assigned a CVSS 7.8 rating. The advisory accompanies a vendor fix for affected installations.

ZDI Published AdvisoriesSep 10, 05:00 UTC · 6d agoAdvisory 3 sources CVE-2025-71414

ZDI-26-671: Adobe Acrobat Reader DC Dialog Object Type Confusion Remote Code Execution Vulnerability

ZDI disclosed a type confusion RCE (CVE-2026-80161, CVSS 7.8) in Adobe Acrobat Reader DC requiring user interaction to exploit.

The Zero Day Initiative published advisory ZDI-26-671 for a Dialog Object type confusion vulnerability in Adobe Acrobat Reader DC. The flaw allows remote attackers to execute arbitrary code when a user opens a malicious file or visits a malicious page. ZDI rated the issue 7.8 on the CVSS scale and assigned CVE-2026-80161. The advisory does not report active exploitation.

ZDI Published AdvisoriesSep 10, 05:00 UTC · 6d agoAdvisory 19 sources CVE-2026-80161

ZDI-26-623: Linux Kernel IPv6 Multicast Routing Use-After-Free Local Privilege Escalation Vulnerability

ZDI-26-623 details a use-after-free in Linux kernel IPv6 multicast routing enabling local privilege escalation, rated CVSS 8.8.

The Zero Day Initiative published ZDI-26-623 describing a use-after-free vulnerability in the Linux kernel's IPv6 multicast routing implementation. A local attacker who can execute low-privileged code on an affected installation can exploit the flaw to escalate privileges. ZDI assigned a CVSS rating of 8.8; the advisory does not name a CVE id or state that exploitation has been observed.

ZDI Published AdvisoriesSep 9, 05:00 UTC · 7d agoAdvisory

ZDI-26-633: GIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability

ZDI disclosed a CVSS 7.8 integer overflow in GIMP's PSP file parser that enables remote code execution when users open malicious files.

ZDI published advisory ZDI-26-633 for an integer overflow in GIMP's parsing of PSP image files. Remote attackers can execute arbitrary code, but exploitation requires user interaction such as opening a malicious file. ZDI assigned CVSS 7.8 and the issue is tracked as CVE-2026-4153.

ZDI Published AdvisoriesSep 9, 05:00 UTC · 7d agoAdvisory CVE-2026-41531

ZDI-26-635: Oracle Outside In Technology PDF File Parsing Integer Overflow Remote Code Execution Vulnerability

ZDI disclosed CVE-2026-60392, an integer overflow in Oracle Outside In PDF parsing enabling remote code execution, rated CVSS 7.8.

The Zero Day Initiative published advisory ZDI-26-635 describing an integer overflow vulnerability in PDF file parsing within Oracle Outside In Technology. Successful exploitation allows remote code execution but requires user interaction, such as opening a malicious file or visiting a malicious page. ZDI assigned the flaw a CVSS rating of 7.8.

ZDI Published AdvisoriesSep 9, 05:00 UTC · 7d agoAdvisory 4 sources CVE-2026-603921

ZDI-26-622: Microsoft Windows IKEv2 AES-GCM Decryption Integer Underflow Remote Code Execution Vulnerability

ZDI disclosed CVE-2026-50696, a CVSS 8.1 integer underflow in Windows IKEv2 AES-GCM decryption enabling unauthenticated remote code execution on specific IPsec configurations.

The Zero Day Initiative published ZDI-26-622 describing a remote code execution vulnerability in Microsoft Windows' IKEv2 AES-GCM decryption path, caused by an integer underflow. Authentication is not required for exploitation, but only systems using specific IPsec configurations are affected. ZDI assigned the vulnerability a CVSS score of 8.1 and the identifier CVE-2026-50696.

ZDI Published AdvisoriesSep 8, 05:00 UTC · 8d agoAdvisory CVE-2026-506961

ZDI-26-621: Microsoft Windows UMPDDrvRealizeBrush Improper Object Management Local Privilege Escalation Vulnerability

ZDI disclosed CVE-2026-62712, a CVSS 7.8 improper object management flaw in Windows UMPDDrvRealizeBrush enabling local privilege escalation after low-privileged code execution.

The Zero Day Initiative published ZDI-26-621 covering a local privilege escalation vulnerability in Microsoft Windows' UMPDDrvRealizeBrush component, caused by improper object management. An attacker must already be able to execute low-privileged code on the target system before exploiting the flaw. ZDI assigned the vulnerability a CVSS score of 7.8 and the CVE identifier CVE-2026-62712.

ZDI Published AdvisoriesSep 8, 05:00 UTC · 8d agoAdvisory 4 sources CVE-2026-627121

ZDI-26-593: NVIDIA TensorRT ONNX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI disclosed a second TensorRT heap-based buffer overflow RCE (CVE-2026-24268, CVSS 7.8) in ONNX file parsing, requiring user interaction.

The Zero Day Initiative published advisory ZDI-26-593 covering another heap-based buffer overflow in NVIDIA TensorRT's ONNX file parsing. A remote attacker can execute arbitrary code if the target opens a malicious file or visits a crafted page. ZDI rated the vulnerability CVSS 7.8 and assigned CVE-2026-24268.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoAdvisory CVE-2026-24268

ZDI-26-589: BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability

ZDI details a network-adjacent stack buffer overflow in BlueZ's A2DP stack (CVE-2026-19774, CVSS 7.1) allowing remote code execution after pairing a malicious Bluetooth device.

The Zero Day Initiative published advisory ZDI-26-589 for a stack-based buffer overflow in BlueZ, the Linux Bluetooth protocol stack. A network-adjacent attacker who can pair a malicious Bluetooth device with the target can execute arbitrary code on the affected installation. The flaw carries a CVSS 7.1 rating and is tracked as CVE-2026-19774.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoAdvisory CVE-2026-19774

ZDI-26-591: NVIDIA TensorRT ONNX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI disclosed a heap-based buffer overflow RCE (CVE-2026-24272, CVSS 7.8) in NVIDIA TensorRT ONNX parsing, requiring user interaction to exploit.

The Zero Day Initiative published advisory ZDI-26-591 covering a heap-based buffer overflow in NVIDIA TensorRT's ONNX file parsing. Successful exploitation allows remote code execution when a user opens a malicious ONNX file or visits a crafted page. ZDI rated the vulnerability CVSS 7.8 and assigned CVE-2026-24272.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoAdvisory CVE-2026-24272

ZDI-26-604: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability

Foxit PDF Reader use-after-free flaw (CVE-2026-13126) allows remote code execution when users open malicious files; CVSS 7.8 per ZDI advisory.

ZDI-26-604 describes a use-after-free vulnerability in Foxit PDF Reader's annotation handling, tracked as CVE-2026-13126 and rated CVSS 7.8. Exploitation requires user interaction, with the target visiting a malicious page or opening a malicious file, and allows remote attackers to execute arbitrary code. The advisory was published by the Zero Day Initiative on August 24, 2026.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoAdvisory CVE-2026-13126

ZDI-26-526: (0Day) PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability

ZDI discloses an unauthenticated, network-adjacent RCE in PAX Technology Q80 payment terminals via installer signature bypass, rated CVSS 7.5.

ZDI-26-526 describes a signature verification bypass in the PAX Technology Q80 application installer that lets network-adjacent attackers execute arbitrary code without authentication. The 0-day is tracked as CVE-2026-19910 and CVE-2026-19911 and carries a CVSS score of 7.5. No public patch was noted at the time of disclosure.

ZDI Published AdvisoriesAug 14, 05:00 UTC · Aug 14, 2026Advisory CVE-2026-19910 CVE-2026-19911

ZDI-26-558: (Pwn2Own) Amazon Smart Plug OTA Update Process Improper Certificate Validation Vulnerability

ZDI disclosed a Pwn2Own certificate validation flaw (CVSS 6.8) in Amazon Smart Plug's OTA process, allowing network-adjacent attackers to bypass update verification.

The Zero Day Initiative published ZDI-26-558 for an improper certificate validation flaw in the Amazon Smart Plug OTA update process, demonstrated at Pwn2Own. Network-adjacent attackers need no authentication to bypass certificate validation for over-the-air updates. ZDI rated the issue CVSS 6.8.

ZDI Published AdvisoriesAug 12, 05:00 UTC · Aug 12, 2026Advisory

ZDI-26-560: (Pwn2Own) Home Assistant Green go2rtc Command Injection Remote Code Execution Vulnerability

ZDI disclosed another Pwn2Own command injection flaw (CVSS 7.5) in Home Assistant Green's go2rtc, enabling network-adjacent code execution after obtaining localhost access.

The Zero Day Initiative published ZDI-26-560 for a second command injection remote code execution flaw in go2rtc on Home Assistant Green, demonstrated at Pwn2Own. Network-adjacent attackers can execute arbitrary code after first obtaining access to the device's localhost interface. ZDI rated the issue CVSS 7.5.

ZDI Published AdvisoriesAug 12, 05:00 UTC · Aug 12, 2026Advisory

ZDI-26-561: (Pwn2Own) Home Assistant Green go2rtc Command Injection Remote Code Execution Vulnerability

ZDI disclosed a Pwn2Own command injection flaw (CVSS 7.5) in Home Assistant Green's go2rtc, enabling network-adjacent attackers to execute arbitrary code via localhost access.

The Zero Day Initiative published ZDI-26-561 for a command injection remote code execution flaw in go2rtc on Home Assistant Green, demonstrated at Pwn2Own. Network-adjacent attackers can execute arbitrary code after first gaining access to the device's localhost interface. ZDI rated the issue CVSS 7.5.

ZDI Published AdvisoriesAug 12, 05:00 UTC · Aug 12, 2026Advisory

ZDI-26-559: (Pwn2Own) Amazon Smart Plug OTA Update Process Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI disclosed a Pwn2Own out-of-bounds write RCE (CVSS 7.5) in Amazon Smart Plug's OTA process, exploitable by unauthenticated network-adjacent attackers.

The Zero Day Initiative published ZDI-26-559 for an out-of-bounds write remote code execution flaw in the Amazon Smart Plug OTA update process, demonstrated at Pwn2Own. Unauthenticated network-adjacent attackers can execute arbitrary code on affected installations. ZDI rated the issue CVSS 7.5.

ZDI Published AdvisoriesAug 12, 05:00 UTC · Aug 12, 2026Advisory

ZDI-26-530: SonicWall Email Security snmp Command Injection Local Privilege Escalation Vulnerability

ZDI advisory discloses SonicWall Email Security snmp command injection local privilege escalation (CVE-2026-66150, CVSS 7.8).

ZDI advisory ZDI-26-530 describes a command injection vulnerability in the snmp component of SonicWall Email Security, tracked as CVE-2026-66150 with a CVSS score of 7.8. Local attackers who can already execute low-privileged code on the target can escalate privileges on affected installations.

ZDI Published AdvisoriesAug 11, 05:00 UTC · Aug 11, 2026Advisory CVE-2026-66150

ZDI-26-539: (Pwn2Own) Microsoft Windows ipt.sys Incorrect Permission Assignment Local Privilege Escalation Vulnerability

ZDI advisory discloses Windows ipt.sys local privilege escalation (CVE-2026-65773, CVSS 7.8) demonstrated at Pwn2Own.

ZDI advisory ZDI-26-539 describes an incorrect permission assignment flaw in Microsoft Windows ipt.sys, tracked as CVE-2026-65773 with a CVSS score of 7.8. A local attacker who can already execute low-privileged code can exploit it to escalate privileges. The vulnerability was demonstrated at Pwn2Own.

ZDI Published AdvisoriesAug 11, 05:00 UTC · Aug 11, 2026Advisory CVE-2026-657731

ZDI-26-554: Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability

ZDI advisory discloses Parallels RAS Client RDP backend service local privilege escalation (CVE-2026-13121, CVSS 7.8).

ZDI advisory ZDI-26-554 describes an exposed dangerous function vulnerability in the RDP backend service of Parallels RAS Client, tracked as CVE-2026-13121 with a CVSS score of 7.8. Local attackers with the ability to execute low-privileged code can escalate privileges on affected installations.

ZDI Published AdvisoriesAug 11, 05:00 UTC · Aug 11, 2026Advisory CVE-2026-13121

ZDI-26-629: Microsoft Azure Entra ID OAuth Device Code Grant Information Disclosure Vulnerability

Zero Day Initiative disclosed an unauthenticated information disclosure vulnerability (CVSS 5.8) in Microsoft Azure Entra ID's OAuth device code grant flow.

ZDI published advisory ZDI-26-629 describing an information disclosure vulnerability in Microsoft Azure Entra ID related to the OAuth device code grant. Remote attackers can disclose sensitive information without authentication. ZDI assigned a CVSS 3.1 score of 5.8; no CVE identifier is listed in the advisory text.

ZDI Published AdvisoriesSep 9, 05:00 UTC · 7d agoAdvisory1

ZDI-26-598: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability

Foxit PDF Reader AcroForm use-after-free (CVE-2026-57242, CVSS 7.8) permits remote code execution through malicious PDF files or pages.

ZDI-26-598 details a use-after-free in the AcroForm component of Foxit PDF Reader, tracked as CVE-2026-57242 and rated CVSS 7.8. A remote attacker can execute arbitrary code if the target opens a malicious file or visits a malicious page. The advisory was published by the Zero Day Initiative on August 24, 2026.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoAdvisory CVE-2026-57242

ZDI-26-594: NVIDIA Megatron Bridge load_model_config Code Injection Remote Code Execution Vulnerability

NVIDIA Megatron Bridge load_model_config code injection flaw (CVE-2026-24251, CVSS 7.8) enables remote arbitrary code execution on affected installs.

ZDI-26-594 describes a code injection vulnerability in NVIDIA Megatron Bridge's load_model_config function, tracked as CVE-2026-24251 with CVSS 7.8. Exploitation allows remote attackers to execute arbitrary code on affected installations and requires user interaction. The advisory was published by the Zero Day Initiative on August 24, 2026.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoAdvisory CVE-2026-24251

ZDI-26-592: NVIDIA TensorRT ONNX File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability

NVIDIA TensorRT improper array index validation in ONNX parsing (CVE-2026-24238, CVSS 7.8) enables remote code execution.

ZDI-26-592 addresses improper validation of array index in NVIDIA TensorRT's ONNX file parsing, tracked as CVE-2026-24238 with CVSS 7.8. Exploitation permits remote code execution on affected installations and requires user interaction. The advisory was published by the Zero Day Initiative on August 24, 2026.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoAdvisory CVE-2026-24238