NVIDIA NVTabular: RCE via Pickle, CVE-2026-24237 Rated CVSS 7.8

A deserialization flaw in NVIDIA NVTabular enables remote code execution through malicious pickle files. User interaction is required; a patch is available.

The Zero Day Initiative disclosed advisory ZDI-26-411 on July 15, 2026, detailing a vulnerability in the NVIDIA NVTabular framework. Tracked as CVE-2026-24237 with a CVSS score of 7.8 (HIGH), the flaw exploits uncontrolled deserialization of pickle files to execute arbitrary Python code in the context of the target process.

Key Takeaways

The defect lies in NVTabular's parsing of pickle files: a lack of user-data validation allows deserialization of untrusted objects.
The documented impact is arbitrary remote code execution (RCE) in the current process, with complete compromise of confidentiality, integrity, and availability.
Exploitation requires user interaction: the victim must visit a malicious page or open a compromised pickle file.
NVIDIA has released a corrective update; coordinated publication occurred on July 15, 2026, following a disclosure initiated on April 14, 2026.
Specific affected versions are not declared in available sources.

FACT The Mechanism: Pickle as an Execution Vector

Python's pickle format enables serialization and deserialization of Python objects. Advisory ZDI-26-411 describes the failure chain: NVTabular's parser processes pickle files without implementing integrity checks, allowing an attacker to inject objects that execute code upon deserialization.

The code executes with the privileges of the NVTabular process. NVTabular operates as a preprocessing component in machine learning pipelines for large-scale tabular data, with direct integrations into cuDF, Dask, and TensorFlow.

"The specific flaw exists within the parsing of pickle files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data." — ZDI Advisory ZDI-26-411

FACT Discrepancies in Rating: CVSS vs. ZDI Advisory

The CVE-2026-24237 record on cve.org assigns the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a Local Attack Vector and No User Interaction. The ZDI advisory text, however, states that "User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file" and refers to "remote attackers."

The AV:L field in the CVSS likely reflects that code execution occurs in the context of a process already running on the target machine, while "remote" in the advisory refers to the attacker's origin delivering the payload. The discrepancy between UI:N and the required interaction remains unresolved in available sources.

ANALYSIS Risk Contexts for Operators

NVTabular is positioned as a reference solution for GPU-accelerated feature engineering. The framework processes large-scale tabular data in ML pipelines, typically in data science and MLOps environments.

Preprocessed datasets in pickle format circulate through public repositories, shared cloud buckets, and CI/CD pipelines. A compromised pickle file inserted into a trusted data flow can reach the NVTabular parser without further security checks.

The ZDI source does not specify whether the typical deployment environment exposes the framework to direct input from untrusted users, nor does it document active exploitation cases. However, NVTabular's common architecture involves processing datasets from external sources, which amplifies the attack surface in the event of compromised data supply chains.

FACT What Changes

NVIDIA has released an update to address the vulnerability. Coordinated publication of advisory ZDI-26-411 occurred on July 15, 2026, following an initial report on April 14, 2026.

The silence on specific affected versions in primary sources leaves operators to verify their exposure through NVIDIA support channels. The absence of a version list prevents immediate estimation of one's attack surface without direct vendor contact.

ANALYSIS Why It Matters

Vulnerability CVE-2026-24237 sits at a critical juncture in the machine learning ecosystem. NVTabular handles preprocessed tabular data that feeds production models; compromise of this pipeline stage enables downstream attacks on decision-making systems.

The pickle format, by its intrinsic nature, is not designed for safe deserialization of untrusted data. The choice to use pickle as an input format without sandboxing or structural validation represents an architectural decision that exposes applications to risks long known in the Python security landscape.

The CVSS 7.8 score, with HIGH impact on confidentiality, integrity, and availability, classifies the vulnerability as a priority for environments processing sensitive data through NVTabular pipelines. The combination of RCE with high CIA impact and the relative simplicity of exploitation via a malicious pickle file makes the threat concrete for organizations that do not track the provenance of preprocessed datasets.

Verifiability Limits Statement

This article relies on three structured primary sources: advisory ZDI-26-411, the ZDI published list confirmation, and the CVE-2026-24237 record. The following elements are not verified in available sources: specific affected NVTabular versions, exact technical details of the pickle payload, presence of a public exploit or PoC demonstration, extent of NVTabular adoption in exposed production environments, correct interpretation of the AV:L/UI:N CVSS discrepancy versus the ZDI description, and a direct NVIDIA patch URL outside the ZDI reference.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references