CVE-2026-24237 is a high severity vulnerability in NVIDIA NVTabular involving improper deserialization of untrusted data (CWE-502). An attacker with local access and low privileges can exploit this flaw to execute arbitrary code, tamper with data, or disclose sensitive information. The vulnerability affects NVTabular versions from 0.0 to 5dd11f4. No vendor advisory or patch is currently available, and the vulnerability is not related to a cloud service. The CVSS vector indicates local attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Exploitation of this vulnerability can result in arbitrary code execution, unauthorized modification of data, and leakage of sensitive information within affected NVTabular environments. The attacker requires local access with low privileges to trigger the vulnerability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the NVIDIA vendor advisory for current remediation guidance. Until a fix is available, restrict local access to trusted users only and monitor for suspicious activity related to NVTabular deserialization processes.