NVIDIA DALI is vulnerable to a stack-based buffer overflow. An attacker that can supply specially crafted data to the DALI library can trigger the overflow, leading to arbitrary code execution, leakage of sensitive information, modification of data, and disruption of services. The weakness is a classic stack corruption flaw (CWE-121) that undermines memory integrity in the running process.

Vendors affected are NVIDIA, specifically the DALI (Data Augmentation Library) component. The vulnerability applies to all releases of DALI prior to the proprietary patch, though version numbers are not listed in the advisory. Users deploying DALI in any environment, including local or cloud-based machine learning workflows, are potentially impacted.

The CVSS v3 score of 7.3 reflects a high severity, and the vulnerability is not listed in the CISA KEV catalog. No EPSS score is published, so the current exploitation probability is unknown. The likely attack vector is via untrusted input processed by DALI; if the attacker can deliver malicious data, control over the execution stack could be achieved. The failure to contain the buffer overflow can result in the attacker’s code being executed with the privileges of the DALI process, exposing the host system to compromise.