PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-24217 NVIDIA CVE debrief

NVIDIA BioNeMo Core for Linux is reported to have a path traversal issue that can be triggered by loading a malicious file. The published severity is high (CVSS 8.8), and the stated impact includes code execution, denial of service, information disclosure, and data tampering. The attack requires user interaction, so the practical risk is highest where untrusted files or datasets are opened in BioNeMo Core workflows.

Vendor
NVIDIA
Product
BioNeMo Framework
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-20
Original CVE updated
2026-05-21
Advisory published
2026-05-20
Advisory updated
2026-05-21

Who should care

Organizations using NVIDIA BioNeMo Core for Linux, especially AI/ML platform teams, Linux administrators, and developers who process external or user-supplied files. Security teams should treat any environment that ingests untrusted model, dataset, or package content as in scope.

Technical summary

Official sources describe the weakness as CWE-29 (path traversal). The NVD record lists CVSS v3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a network-reachable issue with low attack complexity, no privileges required, but user interaction required. In practice, a malicious file loaded by the application may allow access outside intended file paths, which can cascade into confidentiality, integrity, and availability impact.

Defensive priority

High. Prioritize remediation for any exposed or actively used BioNeMo Core for Linux deployment, especially if the application opens untrusted files or supports uploads, imports, or automated ingestion.

Recommended defensive actions

  • Review NVIDIA advisory 5831 and apply the vendor-provided fix or upgrade as soon as it is available.
  • Inventory systems running BioNeMo Core for Linux and identify any workflows that load external or user-controlled files.
  • Restrict file sources to trusted inputs only, and add validation or allowlisting around import and loading paths where possible.
  • Temporarily isolate or limit access to affected systems if patching is delayed, especially in shared AI/ML environments.
  • Monitor for unexpected file access behavior, crashes, or anomalous data changes in BioNeMo Core-related jobs.

Evidence notes

This debrief is based on the NVD CVE record and the linked NVIDIA PSIRT advisory reference. The corpus states the issue is a path traversal vulnerability in NVIDIA BioNeMo Core for Linux, classified as CWE-29, with CVSS 8.8 and the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Published and modified timestamps in the supplied timeline are both 2026-05-20T20:16:36.487Z. No KEV listing was supplied.

Official resources

Publicly disclosed on 2026-05-20, with the CVE record and NVD entry published at 2026-05-20T20:16:36.487Z. The supplied record does not indicate KEV inclusion.