NVIDIA CUDA-Q Vulnerability Poses DoS, Info Disclosure Risk

The National Vulnerability Database has detailed CVE-2026-24189, a high-severity vulnerability (CVSS 8.2) in NVIDIA CUDA-Q. This flaw resides in an endpoint, where an unauthenticated attacker can trigger an out-of-bounds read by submitting a specially crafted request. This isn’t just a theoretical bug; it opens the door to significant operational disruption.

A successful exploit of this vulnerability could lead to denial of service, effectively crippling affected systems. Beyond availability, there’s also a risk of information disclosure, allowing attackers to potentially exfiltrate sensitive data. The ‘unauthenticated’ aspect is critical here – it means anyone can attempt to exploit this without needing prior access or credentials, significantly lowering the bar for attackers.

Defenders need to understand the attacker’s calculus: a high-impact vulnerability that requires no authentication is a prime target for opportunistic and targeted attacks alike. While specific affected products weren’t detailed by the National Vulnerability Database, any organization leveraging NVIDIA CUDA-Q should prioritize identifying their exposure and preparing for a patch, as the potential for unauthenticated DoS and info disclosure is a CISO’s nightmare.