CVE-2026-24255 describes a vulnerability in NVIDIA Dynamo for Linux's multimodal embedding cache. The issue arises because the system performs an incomplete comparison when hashing images, considering only pixel byte sequences but ignoring image dimensions. This allows an attacker to submit different images that hash identically, causing a hash collision. Such collisions can lead to data tampering within the cache. The vulnerability is classified under CWE-1023, which involves incomplete comparisons missing critical factors. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker can exploit this vulnerability to cause hash collisions in the multimodal embedding cache by submitting images with identical pixel byte sequences but different dimensions. This can lead to data tampering within the cache, potentially affecting the integrity of the data processed by NVIDIA Dynamo. There is no reported impact on confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should monitor NVIDIA's advisories for updates. Until a patch is available, cautious handling of inputs to the multimodal embedding cache is advised.