EUVD-2026-41015
GHSA-wf95-v233-352g
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local artifact must be loaded by a victim, so AV:L and UI:R; attacker needs no privileges (PR:N), and pickle-style deserialization yields full C/I/A code execution.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.
Articles & Coverage 1
AnalysisAI
Insecure deserialization in NVIDIA Megatron Bridge for Linux (CWE-502) lets an attacker who supplies a crafted serialized object achieve code execution, privilege escalation, data tampering, and information disclosure when a local user loads that data. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) shows the attack is local and hinges on the victim opening attacker-controlled content, with no public exploit identified at time of analysis. Megatron Bridge is a specialized NVIDIA library for bridging large-language-model training frameworks, so exposure is concentrated in ML/AI training and research environments rather than general enterprise fleets.
Technical ContextAI
The affected component is NVIDIA Megatron Bridge (cpe:2.3:a:nvidia:megatron-bridge), a Linux Python-based tooling layer used to convert and bridge model checkpoints and configurations between Megatron-LM-style training stacks and other frameworks. The root cause is CWE-502 (Deserialization of Untrusted Data): the software reconstructs objects from a serialized stream - typically Python pickle-backed formats such as model checkpoints, config blobs, or cached state - without validating that the stream is trustworthy. Because Python deserialization can invoke arbitrary constructors and reducer callbacks during object reconstruction, a malicious serialized payload can execute code the moment it is loaded, which is the mechanism behind the reported code-execution, privilege-escalation, data-tampering, and information-disclosure impacts.
RemediationAI
Consult NVIDIA's advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5841 and upgrade to the vendor-designated fixed release; a specific patched version number is not present in the provided data, so no vendor-released patch version is independently confirmed at time of analysis - verify the exact fix version directly from that advisory before deploying. As compensating controls until patched, only load model checkpoints, configs, and serialized artifacts from trusted, integrity-verified sources (enforce checksums or signatures on checkpoint files), and avoid deserializing content received from untrusted collaborators, public model hubs, or shared storage; the trade-off is added friction in ML workflows that routinely exchange checkpoints. Where feasible, run Megatron Bridge loading operations in an isolated, least-privileged sandbox or container without sensitive credentials or network egress so a triggered deserialization cannot escalate or exfiltrate - at the cost of pipeline complexity. Do not rely on file extension or path checks alone, since the danger is in the deserialization step itself.
More in Megatron Bridge
View allArbitrary code execution in NVIDIA Megatron Bridge for Linux stems from improper control of code generation (CWE-94), al
Arbitrary code execution in NVIDIA Megatron Bridge (all versions per the NVIDIA advisory) arises from unsafe deserializa
Arbitrary code execution in NVIDIA Megatron Bridge on Linux arises from unsafe reflection (CWE-470), where externally-co
Deserialization of untrusted data in NVIDIA Megatron Bridge for Linux (CWE-502) can lead to arbitrary code execution, pr
Deserialization of untrusted data in NVIDIA Megatron Bridge for Linux allows a low-privileged local attacker to achieve
Local code execution and privilege escalation in NVIDIA Megatron Bridge (Linux) stems from unsafe handling of dynamicall
Local privilege escalation and code execution in NVIDIA Megatron Bridge for Linux stems from unsafe deserialization of a
Arbitrary code execution in NVIDIA Megatron Bridge for Linux arises from unsafe deserialization of untrusted data (CWE-5
Arbitrary code execution and privilege escalation in NVIDIA Megatron Bridge on Linux arises from unsafe deserialization
Server-side request forgery in NVIDIA Megatron Bridge for Linux allows an attacker to coerce the software into issuing a
NVIDIA Megatron Bridge contains a vulnerability in a data shuffling tutorial, where malicious input could cause a code i
NVIDIA Megatron Bridge contains a vulnerability in a data merging tutorial, where malicious input could cause a code inj
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today