CVE-2026-65147 in DALI
Summary
by MITRE • 10/13/2026
NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability might lead to information disclosure and denial of service.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The identified vulnerability within NVIDIA Data Loading Library (DALI) represents a critical memory safety flaw classified as an uncontrolled out-of-bounds read, which aligns with Common Weakness Enumeration identifier CWE-125. This specific type of weakness occurs when software reads data from a memory location that is outside the boundaries of the intended buffer or array structure. In the context of DALI, this typically manifests during the processing of image and video tensors where index calculations for accessing pixel data, metadata, or internal buffers are not sufficiently validated against allocated limits. An attacker who can influence these input parameters through crafted media files or specific API calls can trigger a read operation that accesses memory regions beyond what was originally reserved for the target object.
From an operational perspective, the exploitation of this vulnerability poses significant risks to system integrity and availability. The primary consequence is information disclosure, as the out-of-bounds read allows the attacker to retrieve sensitive data stored in adjacent memory locations. This could include cryptographic keys, user credentials, or proprietary algorithmic logic embedded within the application's address space. Furthermore, depending on how the accessed invalid memory content is subsequently processed by the software, it can lead to unpredictable behavior that results in a denial of service condition. The application may crash due to segmentation faults when attempting to use corrupted data pointers, thereby disrupting continuous processing pipelines and causing downtime for dependent services or applications relying on DALI for high-performance data loading.
This vulnerability maps directly to MITRE ATT&CK technique T1083, which covers File and Directory Discovery, as the out-of-bounds read can be leveraged to enumerate system resources or extract configuration details that facilitate further attacks. It also relates to T1567, Exfiltration Over Web Services, if the disclosed information is subsequently transmitted externally by a compromised application layer. The severity of this issue underscores the importance of rigorous input validation and bounds checking in high-performance computing libraries where memory efficiency is prioritized but must not come at the expense of security boundaries.
To mitigate this vulnerability, it is imperative to apply the latest patches provided by NVIDIA for DALI versions affected by this flaw. Developers integrating DALI into their pipelines should ensure that all library dependencies are updated to secure revisions that include fixes for CWE-125 instances. Additionally, implementing defense-in-depth strategies such as memory protection mechanisms like Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) can reduce the likelihood of successful exploitation by making it more difficult for attackers to predict memory layouts or execute arbitrary code based on disclosed information. Regular security audits focusing on buffer handling in data processing components are also recommended to identify similar weaknesses before they can be exploited in production environments.