CVE-2026-24189 is an out-of-bounds read vulnerability in NVIDIA CUDA-Q affecting all versions before 0.14.0. An unauthenticated attacker can exploit this by sending a maliciously crafted request to a vulnerable endpoint, causing the software to read memory outside the intended bounds. This can result in denial of service conditions and potential information disclosure. The vulnerability is categorized under CWE-125. As of the published date, no official fix or patch has been announced by NVIDIA.

Successful exploitation may cause denial of service by crashing or destabilizing the CUDA-Q service and may expose limited information from out-of-bounds memory reads. The impact is rated high based on CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, indicating network attack vector, low attack complexity, no privileges or user interaction required, with partial confidentiality loss and high availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the vulnerable endpoint and monitor for suspicious activity related to malformed requests targeting CUDA-Q. No official remediation or temporary fix is currently available.