{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24148", "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "state": "PUBLISHED", "assignerShortName": "nvidia", "dateReserved": "2026-01-21T19:09:27.438Z", "datePublished": "2026-03-31T16:22:51.128Z", "dateUpdated": "2026-04-02T03:55:59.949Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "shortName": "nvidia", "dateUpdated": "2026-03-31T16:22:51.128Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-1188", "description": "CWE-1188 Initialization of a Resource with an Insecure Default", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Data tampering, information disclosure, denial of service"}]}], "affected": [{"vendor": "NVIDIA", "product": "Jetson Xavier Series and Jetson Orin Series", "platforms": ["Jetson Linux(35)"], "versions": [{"status": "affected", "version": "All versions prior to 35.6.4"}], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "Jetson Xavier Series and Jetson Orin Series", "platforms": ["Jetson Linux(36)"], "versions": [{"status": "affected", "version": "All versions prior to 36.5"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an unprivileged attacker could cause the initialization of a resource with an insecure default. A successful exploit of this vulnerability might lead to information disclosure of encrypted data, data tampering, and partial denial of service across devices sharing the same machine ID.", "supportingMedia": [{"type": "text/html", "base64": true, "value": "NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an unprivileged attacker could cause the initialization of a resource with an insecure default. A successful exploit of this vulnerability might lead to information disclosure of encrypted data, data tampering, and partial denial of service across devices sharing the same machine ID."}]}], "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24148"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-24148"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5797"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "LOW", "baseSeverity": "HIGH", "baseScore": 8.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "NVIDIA PSIRT"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-24148"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T03:55:59.949Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24148", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-01T14:00:38.048847Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T14:00:41.305Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "impacts": [{"descriptions": [{"lang": "en", "value": "Data tampering, information disclosure, denial of service"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NVIDIA", "product": "Jetson Xavier Series and Jetson Orin Series", "versions": [{"status": "affected", "version": "All versions prior to 35.6.4"}], "platforms": ["Jetson Linux(35)"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "Jetson Xavier Series and Jetson Orin Series", "versions": [{"status": "affected", "version": "All versions prior to 36.5"}], "platforms": ["Jetson Linux(36)"], "defaultStatus": "unaffected"}], "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24148"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-24148"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5797"}], "x_generator": {"engine": "NVIDIA PSIRT"}, "descriptions": [{"lang": "en", "value": "NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an unprivileged attacker could cause the initialization of a resource with an insecure default. A successful exploit of this vulnerability might lead to information disclosure of encrypted data, data tampering, and partial denial of service across devices sharing the same machine ID.", "supportingMedia": [{"type": "text/html", "value": "NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an unprivileged attacker could cause the initialization of a resource with an insecure default. A successful exploit of this vulnerability might lead to information disclosure of encrypted data, data tampering, and partial denial of service across devices sharing the same machine ID.", "base64": true}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1188", "description": "CWE-1188 Initialization of a Resource with an Insecure Default"}]}], "providerMetadata": {"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "shortName": "nvidia", "dateUpdated": "2026-03-31T16:22:51.128Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24148", "state": "PUBLISHED", "dateUpdated": "2026-04-02T03:55:59.949Z", "dateReserved": "2026-01-21T19:09:27.438Z", "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "datePublished": "2026-03-31T16:22:51.128Z", "assignerShortName": "nvidia"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:nvidia:jetson_linux:*:*:*:*:*:*:*:*", "matchCriteriaId": "B73BF007-6D88-4803-B94B-647CCEC5E291", "versionEndExcluding": "35.6.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:nvidia:jetson_linux:*:*:*:*:*:*:*:*", "matchCriteriaId": "23FF116C-64BD-4F4D-960F-92A289CB8150", "versionEndExcluding": "36.5", "versionStartIncluding": "36.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:nvidia:jetson_agx_orin_32gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "D196FDF9-FC0F-4411-826D-5A7416F26159", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_agx_orin_64gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "2392844C-6B11-41EA-A280-3AF1BDB77DC2", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_agx_orin_developer_kit:-:*:*:*:*:*:*:*", "matchCriteriaId": "8A7F9D64-EA34-4309-8B2B-293346BD6D25", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_agx_orin_industrial:-:*:*:*:*:*:*:*", "matchCriteriaId": "211E860F-BEFF-4407-967B-3C1332268D8E", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_agx_xavier_32gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "4F92D471-8E65-41FC-A5DE-255136F6F989", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_agx_xavier_64gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "B51F666B-F3ED-4CF3-B48E-B39BDE1C2579", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_agx_xavier_industrial:-:*:*:*:*:*:*:*", "matchCriteriaId": "3C7C6B22-EBD3-4465-9852-4A4844AA714A", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_orin_nano_4gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "80DA8F1E-9ED6-476A-9C9F-3DC231E5142D", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_orin_nano_8gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "DD549248-1C2C-4A0C-9822-691F3D77AEB1", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_orin_nano_super_developer_kit:-:*:*:*:*:*:*:*", "matchCriteriaId": "6F4ECB54-9725-4BFA-A9E7-2F24EAE5BDAB", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_orin_nx_16gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "6D96D5C9-4F9F-4487-90B9-0D8D473D4C6B", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_orin_nx_8gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "E3CF8EB6-767C-43F8-A327-A2D4A91A7CF1", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_xavier_nx_16gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "A36028A3-EE83-4158-9039-5C6C795FA048", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:jetson_xavier_nx_8gb:-:*:*:*:*:*:*:*", "matchCriteriaId": "22852BE0-B587-48B4-A7B6-6496715C32EF", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an unprivileged attacker could cause the initialization of a resource with an insecure default. A successful exploit of this vulnerability might lead to information disclosure of encrypted data, data tampering, and partial denial of service across devices sharing the same machine ID."}], "id": "CVE-2026-24148", "lastModified": "2026-04-03T19:12:24.300", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.5, "source": "psirt@nvidia.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.5, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-03-31T17:16:29.180", "references": [{"source": "psirt@nvidia.com", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24148"}, {"source": "psirt@nvidia.com", "tags": ["Vendor Advisory"], "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5797"}, {"source": "psirt@nvidia.com", "tags": ["Third Party Advisory"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-24148"}], "sourceIdentifier": "psirt@nvidia.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1188"}], "source": "psirt@nvidia.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": ["jetson_linux(35)"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,35.6.4)"}}], "original": {"product": "Jetson Xavier Series and Jetson Orin Series", "source": "cna", "vendor": "NVIDIA"}, "product": "jetson_orin_series", "vendor": "nvidia"}, {"configurations": [{"platform": ["jetson_linux(36)"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,36.5)"}}], "original": {"product": "Jetson Xavier Series and Jetson Orin Series", "source": "cna", "vendor": "NVIDIA"}, "product": "jetson_orin_series", "vendor": "nvidia"}, {"configurations": [{"platform": ["jetson_linux(35)"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,35.6.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Jetson Xavier Series and Jetson Orin Series", "source": "cna", "vendor": "NVIDIA"}, "product": "jetson_xavier_series", "vendor": "nvidia"}, {"configurations": [{"platform": ["jetson_linux(36)"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,36.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Jetson Xavier Series and Jetson Orin Series", "source": "cna", "vendor": "NVIDIA"}, "product": "jetson_xavier_series", "vendor": "nvidia"}], "analysis": {"en": {"generated_at": "2026-03-31T17:22:01.364593+00:00", "value": {"mitigation_remediation": ["Verify the JetPack version installed and consult NVIDIA release notes for the fix.", "Apply the latest JetPack update that contains the patch for this vulnerability.", "Restrict unprivileged user access to the processes that perform system initialization.", "Monitor system logs for anomalous resource initialization events or unauthorized starts."], "summary": {"action": "Immediate Patch", "impact": "Data confidentiality, integrity and availability risk"}, "threat_synthesis": {"affected_systems": "The advisory targets NVIDIA Jetson Xavier Series and Jetson Orin Series boards that run JetPack installations. Specific affected versions are not listed, so all current releases that use the original initialization routine could be compromised until a patched release is issued.\n", "description_and_impact": "The flaw lies in JetPack\u2019s system initialization logic, where an unprivileged user can force a resource to start with an insecure default. This can expose encrypted data, allow tampering of data, or trigger a partial denial of service across devices that share the same machine ID. The vulnerability is a classic case of improper configuration that breaks confidentiality, integrity and availability.\n", "risk_and_exploitability": "The CVSS score of 8.3 shows high severity, and although EPSS data is unavailable, the flaw is not yet in CISA\u2019s Known Exploited Vulnerabilities catalog. The likely attack vector is a local, unprivileged user able to influence the initialization code, making devices in insecure or shared environments especially vulnerable. The impact includes potential leakage of encrypted information, manipulation of system data, and limited service interruption."}}}}, "created": "2026-03-31T19:53:59.657151+00:00", "title": "Privilege-Based Resource Initialization Weakness on NVIDIA Jetson Devices", "updated": "2026-03-31T20:37:57.215662+00:00", "vendors": ["nvidia", "nvidia$PRODUCT$jetson_orin_series", "nvidia$PRODUCT$jetson_xavier_series"]}