Publication date of this article: 12th June 2026

Preface: Because CVE-2025-54509 breaks that cryptographic isolation, it directly undermines the core trust assumption of AMD SEV-SNP because the hypervisor is the only entity that is supposed to be blocked by SEV-SNP, but is granted unauthorized access by this flaw.

Background: To understand why security advisories and researchers (such as the team behind the “Staleus” attack paper) specifically quote a “malicious hypervisor” even though a bare-metal host OS kernel has the exact same native authority.

But the crucial IOMMU only triggers when a peripheral device acts as the master and initiates a transaction over the PCIe/system bus.

How about MMU? MMU protects the system from unauthorized CPU access to memory and device registers.

The official vulnerability note described that an improper access control for register interface in the input-output memory management unit (IOMMU) could allow a privileged attacker. For example, AMD EPYC 9965 is explicitly built for High-Performance Computing (HPC) clusters. The AMD EPYC 9965 is engineered for high-density, multi-tenant computing environments, and it utilizes a massive PCIe 5.0 bus architecture. Processors, especially in heterogeneous systems (CPUs, GPUs, and accelerators) and embedded environments, use non-coherent memory access primarily to achieve higher performance, reduce power consumption, and minimize hardware complexity.

Ref:Non-coherent memory access occurs when multiple agents (like a CPU and a DMA controller) access the same memory location, but their local caches are not automatically synchronized, leading to potential data inconsistencies. It requires software to explicitly manage cache maintenance (flushing or invalidating) to ensure data integrity.

Vulnerability details:

Primary Target Generation – 5th Gen AMD EPYC (Turin) platforms.

Exploitation Core Flaw – Lack of access control rules governing IOMMU memory-coherency configuration registers.

Attack Execution Mechanics – Host flips a bit forcing the AMD Secure Processor (ASP) to use non-coherent lines, pulling stale table data directly from DRAM.

Security Impact Profile – Complete collapse of Reverse Map Table (RMP) validation, causing cross-domain integrity failures.

Primary Remediation – SB-3039 PI microcode patch + operating system level MMIO mapping restrictions.

Official announcement: Please refer to the link for details – https://nvd.nist.gov/vuln/detail/CVE-2025-54509

Preface: The attached diagram illustrates how an attacker could trigger the CVE-2026-24180 and CVE-2026-24181 vulnerabilities. This diagram serves as a visual aid for threat modeling, dividing the attack vector into two main paths within the NVIDIA Data Load Library (DALI) data processing pipeline.

Background: As shown in the figure, the following detailed information explains how this vulnerability occurred.

1. The Deserialization Vector (The “Pickle Bomb”)

Sections 4 and 5 of the diagram map out how an attacker executes arbitrary code using insecure data parsing:

•The Vulnerability Layer: When DALI processes batches or training checkpoints, it relies on Python’s built-in pickle.loads() function to reconstruct data objects.

•The Exploit Execution: An attacker supplies a maliciously crafted dataset or checkpoint file containing a specialized payload. As shown in the code snippet, when pickle.loads() evaluates the serialized byte stream, it invokes the native Python __reduce__ method. This allows the attacker to step outside the memory sandbox and automatically run system commands with the host program’s privileges.

2. The Memory Boundary Vector (Heap Buffer Overflow)

Sections 2 and 3 explain how memory corruption occurs on the backend during media loading:

•The Vulnerability Layer: DALI leverages CPU/GPU-accelerated multimedia codecs (like libjpeg-turbo and nvJPEG) to pre-parse incoming audio tracks and JPEG image segments.

•The Exploit Execution: The software lacks strict bounds validation for input structures. An attacker passes a specialized file containing mutated headers, altered dimensions, or oversized network packets. Because the system does not verify these bounds, the file metadata triggers an integer or buffer mismatch, forcing data to overrun the allocated limits of the heap memory sector. This results in an out-of-bounds write or read sequence, compromising the stability of downstream frameworks like PyTorch, TensorFlow, or MXNet.

Furthermore, a heap-based buffer overflow in a data loading library is almost always caused by improper data validation. It occurs when the library fails to check input bounds—such as when processing image files, network packets, or file headers—allowing crafted data to exceed the allocated heap buffer’s capacity and overwrite adjacent memory.

Vulnerability details:

CVE-2026-24180 NVIDIA DALI contains a vulnerability in a component where an attacker could cause a heap-based buffer overflow. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.

CVE-2026-24181 NVIDIA DALI contains a vulnerability in a component where an attacker could cause an improper index validation. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.

Official announcement: Please refer to the link for details – https://nvidia.custhelp.com/app/answers/detail/a_id/5814

Preface: Flowise is an open-source, low-code tool that enables users to build customized Large Language Model (LLM) orchestration flows and AI agents using a visual, drag-and-drop interface based on LangChain. It allows for rapid development of AI applications without extensive coding, connecting LLMs (OpenAI, Anthropic, Local via Ollama) with tools, vector stores, and memory.

Background: When you install Flowise in a Docker container, the NodeVM sandbox environment is included within that same container. Flowise uses this NodeVM to securely execute custom JavaScript code (e.g., in Custom JS Function nodes) inside its own runtime environment.

NodeVM (a class from sandboxing libraries like vm2) is a software mechanism used inside JavaScript code to run untrusted code in an isolated scope. NVM (Node Version Manager) is a command-line developer utility used to install and switch between different versions of Node.js on a local machine or server.

Best Practices for Production

Enable Strict Sandbox: Always ensure the JAVASCRIPT_SANDBOX environment variable is set to true in your Docker compose file to prevent unrestricted Node module imports.

Limit Container Privileges: Run the Docker container as a non-root user to minimize damage if a sandbox escape occurs.

Restrict Network Egress: Use Docker network policies to block the Flowise container from accessing sensitive internal networks or databases it does not need.

Vulnerability details: Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When E2B_APIKEY is not configured — the common deployment case — Flowise executes this code inside a NodeVM sandbox. This sandbox can be escaped, allowing an attacker to reach the host process object and execute system commands via child_process. The result is authenticated remote code execution on the Flowise server host.

Remedy: This issue has been patched in version 3.1.2.

Official announcement: Please refer to link for details – https://www.tenable.com/cve/CVE-2026-46442

(4^th June 2026)

Preface: From a security engineering standpoint, there is no conceptual difference in the attack mechanism. Both the older vulnerabilities (CVE-2025-33214 / CVE-2025-33213) and the newer ones shown in the diagram share the exact same root weakness: Insecure Deserialization (CWE-502) via Python’s built-in pickle module.

Background:

NVIDIA Merlin & NVTabular (The Pipeline Base) –

NVIDIA Merlin is an end-to-end framework designed to accelerate deep learning recommender systems (RecSys). Within this ecosystem, NVTabular acts as the heavy-lifter for the ETL (Extract, Transform, Load) stage. It uses GPU-accelerated RAPIDS cuDF and Dask under the hood to handle multi-terabyte tabular datasets that exceed system CPU memory.

Integration with cuML and PyTorch –

To achieve maximum throughput, the pipeline passes these highly optimized, GPU-aligned data tensors directly into training frameworks (like PyTorch) or machine learning libraries (like cuML for clustering, classification, or collaborative filtering). The critical security boundary exists where these components save, transfer, or load their execution states across different nodes or microservices.

Vulnerability details: Both CVE-2026-24237 and CVE-2026-24221 are categorized under CWE-502: Deserialization of Untrusted Data.

• Serialization is the process of converting an in-memory object (like an NVTabular transformer setup or a cuML model state) into a byte stream for storage or transmission.
• Deserialization reverse-engineers that byte stream back into an active living object in memory.

Why Python’s pickle Module is Inherently Insecure?

The flaw stems from the pipeline’s reliance on Python’s native pickle module for saving and reloading model states or custom transformer pipelines.

pickle is not a safe serialization format because it does not just store raw data; it stores object reconstruction instructions. It utilizes a stack-based virtual machine (the Pickle VM) to execute these instructions sequentially when building the object back up.

Official announcement: Please refer to link for details – https://nvidia.custhelp.com/app/answers/detail/a_id/5851