NVIDIA DeepStream allows users to define tensor dimensions in YAML configuration files. An attacker who can supply a crafted file can trigger an integer overflow when the dimensions are processed. This flaw can cause the application to crash or corrupt internal state, potentially leading to denial of service, leakage of sensitive data, or manipulation of processed outputs. The weakness is a classic integer overflow (CWE‑190).

The vulnerability affects NVIDIA DeepStream installations that accept user‑supplied YAML configuration files. No specific version range is listed in the advisory, so any release that has not yet applied the vendor’s patch is potentially affected. Systems running DeepStream in production environments are at risk if configuration files can be altered by unauthorized users.

The CVSS score of 7.8 indicates a high severity impact. The EPSS score is not available, so the current likelihood of exploitation in the wild is uncertain. The vulnerability is not in the CISA KEV catalog, suggesting no known widespread exploitation yet. The attack would likely be performed by an adversary with the ability to create or modify the YAML file, which could be delivered remotely via compromised web interfaces or gained locally through file upload mechanisms. Once the overflow occurs, the attacker can destabilise the stream processing pipeline or cause secret data leakage.