CVE-2026-24162 is a deserialization vulnerability (CWE-502) in NVIDIA Merlin Transformers4Rec for Linux. It allows an attacker to supply crafted input that is improperly deserialized, potentially leading to remote code execution, data integrity compromise, and information leakage. The vulnerability affects all commits on the main branch before March 11, 2026. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability.

Successful exploitation could result in arbitrary code execution on the affected system, unauthorized modification of data, and disclosure of sensitive information. Given the local attack vector and requirement for user interaction, exploitation is somewhat constrained but still poses a significant risk to system security and data confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid processing untrusted serialized data with affected versions. Monitor NVIDIA's official channels for updates and apply patches promptly once available.