NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause a NULL pointer dereference. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering.

CVE-2026-24263 affects NVIDIA DGX Spark system firmware, where a privileged attacker can trigger a NULL pointer dereference. Successful exploitation may lead to code execution, privilege escalation, denial of service, information disclosure, and data tampering. The vulnerability requires privileged access to exploit, limiting the attack surface somewhat. However, the breadth of potential impact makes this a high-severity issue. NVIDIA has published an advisory via their product-security GitHub repository. The vulnerability is tracked by both the NVD and CVE databases. Users of NVIDIA DGX Spark systems should apply firmware updates as soon as they become available.