CVE-2026-24255 Overview
CVE-2026-24255 affects NVIDIA Dynamo for Linux. The vulnerability resides in the multimodal embedding cache, which hashes image inputs to key cached embedding results. An attacker can submit two images that share an identical pixel byte sequence but differ in dimensions, producing a hash collision. Successful exploitation can lead to data tampering by returning embeddings associated with a different image than the one submitted. The flaw is network-accessible, requires no privileges, and requires no user interaction. NVIDIA product security tracks this issue in bulletin 5842. The weakness maps to [CWE-1023] Incomplete Comparison with Missing Factors.
Critical Impact
A remote, unauthenticated attacker can force cache hash collisions to tamper with multimodal embedding results returned by NVIDIA Dynamo.
Affected Products
- NVIDIA Dynamo for Linux
- Multimodal embedding cache component
- Deployments serving image-based inference through Dynamo
Discovery Timeline
- 2026-08-04 - CVE-2026-24255 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-24255
Vulnerability Analysis
NVIDIA Dynamo caches computed embeddings for multimodal inputs to avoid recomputing expensive model outputs. The cache uses a hash derived from the raw pixel byte sequence of the image. The hashing routine does not incorporate image dimensions as a distinguishing factor. Two images that contain the same pixel bytes but declare different dimensions produce the same cache key. When the second image is submitted, the cache returns the embedding computed for the first. Downstream inference then operates on data that does not correspond to the actual submitted image. This creates an integrity failure in the inference pipeline and can influence model output for other tenants sharing the cache.
Root Cause
The root cause is an incomplete comparison in the cache key derivation, consistent with [CWE-1023]. Dimensional metadata such as width, height, and channel count is excluded from the hash input. Because the raw pixel buffer alone is insufficient to uniquely represent a decoded image, distinct logical images map to a single cache entry. The cache treats the hash match as proof of equivalence and skips recomputation.
Attack Vector
Exploitation is remote and unauthenticated. An attacker crafts two images that share an identical pixel byte sequence but different declared dimensions, for example by reinterpreting a W x H buffer as H x W. The attacker first submits the benign image to prime the cache. The attacker then submits the second image, which collides on the hash key and receives the embedding tied to the primed input. In multi-tenant serving scenarios, this can cause tampering of results returned to legitimate users. No exploit code has been publicly reported, and the vulnerability is not listed in CISA KEV.
No verified public proof-of-concept code is available. Refer to the NVIDIA product security advisory for authoritative technical detail.
Detection Methods for CVE-2026-24255
Indicators of Compromise
- Repeated inference requests submitting images with identical file sizes but differing declared dimensions from the same client or IP.
- Cache hit patterns in Dynamo telemetry showing collisions across requests with mismatched image metadata.
- Anomalous inference results where returned embeddings do not correspond to the submitted image content.
Detection Strategies
- Instrument the multimodal embedding cache to log key derivation inputs, including dimensions, and alert when identical hashes map to differing dimension tuples.
- Correlate inference API request logs to identify clients submitting reshaped variants of previously observed pixel buffers.
- Baseline expected cache hit ratios per tenant and flag deviations that suggest deliberate priming.
Monitoring Recommendations
- Forward Dynamo inference logs and cache metrics to a centralized analytics platform for retrospective hunting.
- Monitor upstream API gateways for high-volume image submissions preceding cache-hit spikes.
- Track model output distributions for tenants to detect drift consistent with tampered embeddings.
How to Mitigate CVE-2026-24255
Immediate Actions Required
- Apply the fix referenced in NVIDIA product security bulletin 5842 once available for your Dynamo release.
- Restrict network access to Dynamo inference endpoints to trusted clients and authenticated services.
- Audit multi-tenant deployments to identify whether embedding cache entries are shared across tenants.
Patch Information
Refer to the NVIDIA product security repository entry for 5842 and the NVD record for CVE-2026-24255 for the fixed release information and update guidance.
Workarounds
- Disable the multimodal embedding cache in Dynamo until a patched release is deployed.
- Partition the cache per tenant or per session to limit the reach of any collision.
- Add a preprocessing step that incorporates image dimensions into the request identifier before it reaches the cache layer.
# Configuration example: disable shared multimodal embedding cache
# Consult NVIDIA Dynamo documentation for the exact directive in your release
dynamo config set multimodal.embedding_cache.enabled false
dynamo config set multimodal.embedding_cache.scope per-tenant
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
