Read the docs
TI-2026-19463 Aliases CVE-2026-24148GHSA-76h5-vm7x-9f4c

NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic…

Priority MEDIUM 42CWE-1188Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an unprivileged attacker could cause the initialization of a resource with an insecure default. A successful exploit of this vulnerability might lead to information disclosure of encrypted data, data tampering, and partial denial of service across devices sharing the same machine ID.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00355 29th percentileScored 2026-11-07
Fix Fixed Jetson Xavier Series and Jetson Orin Series (NVIDIA): 35.6.4, 36.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NVIDIAJetson Xavier Series and Jetson Orin Seriesbefore 35.6.435.6.4Patch availableCNA
NVIDIAJetson Xavier Series and Jetson Orin Seriesbefore 36.536.5Patch availableCNA
  • Jetson Xavier Series and Jetson Orin Series VendorNVIDIA Affected before 35.6.4 Fixed in 35.6.4 Patch available CNA
  • Jetson Xavier Series and Jetson Orin Series VendorNVIDIA Affected before 36.5 Fixed in 36.5 Patch available CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:o:nvidia:jetson_linux:*:*:*:*:*:*:*:*before 35.6.4; 36.0 to before 36.5VulnerableNVIDIA
cpe:2.3:h:nvidia:jetson_agx_orin_32gb:-:*:*:*:*:*:*:*not specified by NVDRunning onNVIDIA
cpe:2.3:h:nvidia:jetson_agx_orin_64gb:-:*:*:*:*:*:*:*not specified by NVDRunning onNVIDIA
cpe:2.3:h:nvidia:jetson_agx_orin_developer_kit:-:*:*:*:*:*:*:*not specified by NVDRunning onNVIDIA
cpe:2.3:h:nvidia:jetson_agx_orin_industrial:-:*:*:*:*:*:*:*not specified by NVDRunning onNVIDIA
cpe:2.3:h:nvidia:jetson_agx_xavier_32gb:-:*:*:*:*:*:*:*not specified by NVDRunning onNVIDIA
cpe:2.3:h:nvidia:jetson_agx_xavier_64gb:-:*:*:*:*:*:*:*not specified by NVDRunning onNVIDIA
cpe:2.3:h:nvidia:jetson_agx_xavier_industrial:-:*:*:*:*:*:*:*not specified by NVDRunning onNVIDIA
cpe:2.3:h:nvidia:jetson_orin_nano_4gb:-:*:*:*:*:*:*:*not specified by NVDRunning onNVIDIA
cpe:2.3:h:nvidia:jetson_orin_nano_8gb:-:*:*:*:*:*:*:*not specified by NVDRunning onNVIDIA
  • cpe:2.3:o:nvidia:jetson_linux:*:*:*:*:*:*:*:* Versions before 35.6.4; 36.0 to before 36.5 Vulnerable ·NVIDIA
  • cpe:2.3:h:nvidia:jetson_agx_orin_32gb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
  • cpe:2.3:h:nvidia:jetson_agx_orin_64gb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
  • cpe:2.3:h:nvidia:jetson_agx_orin_developer_kit:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
  • cpe:2.3:h:nvidia:jetson_agx_orin_industrial:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
  • cpe:2.3:h:nvidia:jetson_agx_xavier_32gb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
  • cpe:2.3:h:nvidia:jetson_agx_xavier_64gb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
  • cpe:2.3:h:nvidia:jetson_agx_xavier_industrial:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
  • cpe:2.3:h:nvidia:jetson_orin_nano_4gb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
  • cpe:2.3:h:nvidia:jetson_orin_nano_8gb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:nvidia:jetson_orin_nano_super_developer_kit:-:*:*:*:*:*:*:*not specified by NVDRunning onNVIDIA
cpe:2.3:h:nvidia:jetson_orin_nx_16gb:-:*:*:*:*:*:*:*not specified by NVDRunning onNVIDIA
cpe:2.3:h:nvidia:jetson_orin_nx_8gb:-:*:*:*:*:*:*:*not specified by NVDRunning onNVIDIA
cpe:2.3:h:nvidia:jetson_xavier_nx_16gb:-:*:*:*:*:*:*:*not specified by NVDRunning onNVIDIA
cpe:2.3:h:nvidia:jetson_xavier_nx_8gb:-:*:*:*:*:*:*:*not specified by NVDRunning onNVIDIA
  • cpe:2.3:h:nvidia:jetson_orin_nano_super_developer_kit:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
  • cpe:2.3:h:nvidia:jetson_orin_nx_16gb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
  • cpe:2.3:h:nvidia:jetson_orin_nx_8gb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
  • cpe:2.3:h:nvidia:jetson_xavier_nx_16gb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
  • cpe:2.3:h:nvidia:jetson_xavier_nx_8gb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA

Remediation

  • Fix · CNA Jetson Xavier Series and Jetson Orin Series (NVIDIA) Fixed in 35.6.4
  • Fix · CNA Jetson Xavier Series and Jetson Orin Series (NVIDIA) Fixed in 36.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-24148
  2. 2026-10-03 Alias added: GHSA-76h5-vm7x-9f4c

References

Advisory 3

  • TI-2024-00097 Improper handling of exceptional conditions in NVIDIA Jetson AGX Xavier series, Jetson… CVSS 3.1HIGH 8.8
  • TI-2022-20491 Improper input validation in NVIDIA Jetson AGX Xavier series, Jetson Xavier NX, Jetson… CVSS 3.1HIGH 7.9
  • TI-2026-19469 OS command injection in NVIDIA Jetson Xavier Series, Jetson Orin Series and Jetson Thor CVSS 3.1HIGH 7.6
  • TI-2022-20492 Stack-based buffer overflow in NVIDIA Jetson AGX Xavier Series, Jetson Xavier NX, Jetson… CVSS 3.1HIGH 7.8
  • TI-2021-13407 Integer overflow in NVIDIA Jetson TX2 series, TX2 NX, AGX Xavier series, Xavier NX CVSS 3.1HIGH 8.2
  • TI-2021-13423 Out-of-bounds write in NVIDIA Jetson TX1, TX2 series, TX2 NX, AGX Xavier series, Xavier… CVSS 3.1HIGH 7.8
See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences