CVE-2026-47612 is a path traversal vulnerability in NVIDIA Dynamo's image loading path, rated High severity but with an EPSS score suggesting roughly 0.5% probability of active exploitation within 30 days. That discrepancy deserves attention: the Low EPSS likely reflects the specific trust boundary required to exploit this flaw rather than diminished severity.
NVIDIA Dynamo operates within ML inference pipelines, typically embedded in model serving contexts where image paths originate from configuration or authenticated API calls rather than direct untrusted user input. This is the key exploitation precondition: an attacker needs positioning within the inference pipeline to control the path argument passed to the image loader—either through malicious model configurations, crafted API requests to a model endpoint, or injection into pipeline orchestration. If your Dynamo deployment only loads images from trusted, pre-configured paths in your own storage, the practical attack surface may be negligible despite the High CVSS.
The more important question is what happens after successful exploitation. Path traversal in this context isn't just file disclosure—it's the entry point to a cascade including model weights, training data, configuration files containing API keys, and container environment variables with credentials. NVIDIA's own history shows similar path traversal flaws in CUDA image loaders (2021) and container runtime model artifact loading (2023), each following the same canonicalization bypass pattern and each resolving with similar fixes. This recurrence pattern suggests the documented API contract—which assigns path sanitization responsibility to callers—hasn't been reinforced with library-level enforcement.
For defenders: treat this as a library boundary vulnerability. Audit where untrusted input can reach Dynamo's image loading functions, implement explicit path canonicalization and directory containment checks at your application layer if the library doesn't provide it, and prioritize remediation in deployments with external API exposure. The EPSS may be low, but the blast radius in ML contexts—where artifact theft enables supply chain compromise—warrants serious prioritization regardless.