Preface: NVIDIA NeMo is a widely adopted, end-to-end framework for building, customizing, and deploying generative AI models (LLMs) and conversational AI agents. It is primarily used to tailor open-source models—such as Llama, Mistral, and Google Gemma—using proprietary enterprise data.

Ollama, Mistral, and Google Gemma represent a powerful ecosystem for running local, open-weight Large Language Models (LLMs). Ollama acts as the engine to run models, while Mistral and Gemma are two of the most popular, high-performing model families designed to be efficient enough to run on personal computers.

Ollama itself does not use Nvidia NeMo; Ollama is an open-source runtime designed to pull, manage, and run LLMs (like Llama, Mistral, and Gemma) locally on consumer hardware. However, Mistral and Google actively collaborate with Nvidia, meaning their models frequently utilize Nvidia’s NeMo framework and are accessible via tools like NVIDIA NIM.

Background: A model_weights[.]ckpt file is a checkpoint file that stores the learned parameters (weights and biases) of a neural network. When serialized using Python’s pickle module, the file contains a bytecode payload representing the pickled Python dictionary of arrays, which poses arbitrary code execution risks during deserialization.

The attached infographic details CVE-2026-24252, a critical security vulnerability that could lead to operating system command injection in NVIDIA NeMo for Linux.

How the Exploit Works

1. Malicious file creation: Attackers package custom code into [.]nemo checkpoints.
2. Abusing Pickle: They use Python’s __reduce__ method.
3. Command payload: This method embeds arbitrary shell commands.
4. Target execution: The victim opens the file locally.
5. Deserialization trigger: NeMo calls pickle[.]load() automatically.
6. System compromise: The OS executes the injected command immediately.

Vulnerability details: CVE-2026-24252 NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A successful exploit of this vulnerability may lead to code execution, data tampering, escalation of privileges and information disclosure.

Remedy: Modern versions of PyTorch and NeMo mitigate this by passing weights_only=True to the loading mechanism. This instructs the deserializer to strictly accept only raw data arrays (like your original np[.]random[.]randn arrays) and explicitly reject any custom Python classes or executable instructions.

Official announcement: Please refer to the link for details – https://nvidia.custhelp.com/app/answers/detail/a_id/5839