Cyber Security News

Critical NVIDIA Vulnerabilities Risk Remote Code Execution and Denial-of-Service Attacks

NVIDIA has recently published its March 2026 security bulletins, addressing a wave of newly discovered vulnerabilities across its hardware and software ecosystems.

The technology giant has urged organizations to immediately evaluate their environments and apply the necessary corrective actions to prevent potential exploitation.

These vulnerabilities pose significant risks, notably enabling threat actors to potentially execute arbitrary code or trigger denial-of-service conditions on affected systems.

The most severe flaw identified in this release affects NVIDIA Apex, a popular extension used in artificial intelligence workflows.

Tracked under bulletin 5782, this critical vulnerability requires immediate attention from researchers and enterprise security teams.

Several other high-severity vulnerabilities were discovered across NVIDIA’s machine learning infrastructure, including the Triton Inference Server, Model Optimizer, NeMo Framework, and Megatron LM.

Additionally, medium-severity issues were patched in the NVIDIA VIRTIO-Net, SNAP4, and the B300 MCU product lines.

NVIDIA strongly encourages Coordinated Vulnerability Disclosure, a process that allows independent researchers to privately report security flaws so that patches can be developed before public exploitation occurs.

Once a vulnerability is discovered, NVIDIA commits the appropriate resources to thoroughly analyze, validate, and remediate the issue.

The company relies on standardized scoring frameworks to assess security risks, helping IT administrators prioritize their patching and incident response strategies.

To meet growing industry demand for automated vulnerability management, NVIDIA has modernized its security advisory distribution.

Since October 1, 2025, the NVIDIA Product Security Incident Response Team (PSIRT) has been publishing security bulletins on a dedicated GitHub repository.

This strategic shift ensures that security advisories are available in multiple formats, including human-readable Markdown for quick analysis, machine-readable Common Security Advisory Framework (CSAF) for automated processing, and supplementary CVE files containing standard record formats.

Both the traditional Product Security website and the new GitHub repository run in parallel to ensure continuous access.

NVIDIA recommends that all customers subscribe to email notifications to stay informed about initial releases or major revisions to these security bulletins.

Administrators must prioritize updating the specified driver and software packages to mitigate these emerging threats effectively.

March 2026 NVIDIA Security Bulletins

ProductBulletin IDSeverityCVE Identifier(s)Publish Date
NVIDIA VIRTIO-Net, SNAP45744MediumCVE-2025-33215, CVE-2025-33216 24 Mar 2026
NVIDIA Apex5782CriticalCVE-2025-33244 24 Mar 2026
NVIDIA B300 MCU5768MediumCVE-2025-33242 24 Mar 2026
NVIDIA Triton Inference Server5790HighCVE-2025-33238, CVE-2025-33254, CVE-2026-24158 24 Mar 2026
NVIDIA Model Optimizer5798HighCVE-2026-24141 24 Mar 2026
NVIDIA NeMo Framework5800HighCVE-2026-24157, CVE-2026-24159 24 Mar 2026
NVIDIA Megatron LM5769HighCVE-2025-33247, CVE-2025-33248, CVE-2026-24152, CVE-2026-24151, CVE-2026-24150 24 Mar 2026

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Recent Posts

Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups

Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…

1 day ago

Anthropic’s Claude AI Uncovers Origins of NSA-Provided Cryptographic Keys After 25 Years

Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…

1 day ago

Critical WordPress Flaws Allow Attackers to Execute Remote Code Without Authentication

Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…

1 day ago

OpenBSD Kernel Flaw Dating Back 37 Years Enables Local Privilege Escalation to Root

A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…

1 day ago

GhostAction Hackers Hide Credential-Stealing Malware in Fake Font Files Across 94 GitHub Repositories

GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…

1 day ago

SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data

Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…

2 days ago