CVE-2026-24221 is a deserialization vulnerability (CWE-502) in NVIDIA NVTabular that allows an attacker with local access and low privileges to cause improper deserialization of untrusted data. This can lead to high impact outcomes including code execution, data tampering, and information disclosure. The vulnerability affects NVTabular versions from 0.0 through 5dd11f4. The CVSS v3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality, integrity, and availability impacts. No vendor advisory or patch information is currently available.

Successful exploitation could result in arbitrary code execution, unauthorized modification of data, and leakage of sensitive information within affected NVTabular environments. The vulnerability requires local access with low privileges and does not require user interaction. The overall impact is high due to the potential for full system compromise within the affected context.

Patch status is not yet confirmed — check the NVIDIA vendor advisory for current remediation guidance. Until a fix is available, restrict access to NVTabular environments to trusted users only and monitor for suspicious activity related to deserialization processes. Avoid processing untrusted or unauthenticated data inputs where possible.