Preface: When running workloads like Apache Spark using CUDA acceleration on an NVIDIA DGX Spark (powered by the GB10 Grace Blackwell Superchip), the performance improvement over a top-grade Intel or AMD CPU desktop is massive—often ranging from 3x to over 20x faster, depending on the exact task.
Background: The design goal of the Nvidia DGX Spark is to bring enterprise-grade AI supercomputing out of large data centers and onto an individual researcher’s or developer’s desktop.
When you compile code using the CUDA compiler (nvcc), the final executable is not a purely standalone GPU program. Instead, it becomes a heterogeneous application that splits tasks between your CPU and GPU. Therefore, CUDA is actively involved when the converted program runs. When a user launches the compiled program, the CUDA Runtime Library (cudart) must be running in the background to act as a bridge.
The system firmware is active during the OS lifecycle, but its memory is isolated. But the vulnerabilities CVE-2026-24262 and CVE-2026-24263 specifically address out-of-bounds writes in the DGX Spark system firmware.If an attacker triggers these out-of-bounds writes, the hardware memory isolation will not prevent an exploit. This highlights why the threat model is more severe than it appears.
If an attacker with local OS privileges leverages a flaw in a system utility (like an unchecked buffer in an ACPI or SCMI mailbox call), they can force the firmware to write data past its intended memory buffer. This allows them to inject and run malicious code inside the context of the firmware.
Vulnerability details:
CVE-2026-24262 NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering.
CVE-2026-24263 NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause a NULL pointer dereference. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering.
Official announcement: Please refer to the link for details –