ZDI-26-787: NVIDIA Megatron Bridge YAML File Parsing Code Injection Remote Code Execution Vulnerability

CVE-2026-24250 is a remote code execution vulnerability in NVIDIA Megatron Bridge caused by code injection through unsafe YAML file parsing. An attacker can exploit this flaw by tricking a user into visiting a malicious page or opening a malicious file, leading to arbitrary code execution on the affected system. The vulnerability has a CVSS rating of 7.8 as assigned by the Zero Day Initiative.

Successful exploitation allows remote attackers to execute arbitrary code on affected installations of NVIDIA Megatron Bridge, potentially compromising the system. User interaction is required for exploitation, limiting the attack vector to scenarios involving malicious content delivery.

No patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid opening untrusted files or visiting suspicious websites that could exploit this vulnerability.