EUVD-2026-41017
GHSA-h8c2-j9cr-f3p6
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector since the attacker must supply serialized data to a local process (AV:L); a low-privileged user triggers it without interaction (PR:L, AC:L, UI:N); deserialization RCE yields full C/I/A impact.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.
Articles & Coverage 1
AnalysisAI
Deserialization of untrusted data in NVIDIA Megatron Bridge for Linux allows a low-privileged local attacker to achieve code execution, privilege escalation, data tampering, and information disclosure. Megatron Bridge is NVIDIA's model-interoperability tooling used to convert and load large-language-model checkpoints in the Megatron/PyTorch training stack, where unsafe object deserialization (CWE-94) lets attacker-controlled serialized data run arbitrary code in the process context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 7.8 (High) rating with full C/I/A impact makes it a meaningful risk on shared or multi-tenant ML infrastructure.
Technical ContextAI
Megatron Bridge is a Python-based bridge/conversion layer in NVIDIA's Megatron-LM ecosystem for loading, converting, and interoperating LLM model checkpoints and state between formats used in distributed GPU training and inference. The CPE cpe:2.3:a:nvidia:megatron-bridge:*:* confirms the affected component is the application itself across unspecified versions. The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection) driven by deserialization of untrusted data - a pattern endemic to the ML ecosystem where checkpoints and configs are commonly loaded via Python pickle or pickle-backed formats (e.g., torch.load), which reconstruct arbitrary objects and can invoke attacker-defined code during unpickling. If a maliciously crafted checkpoint, config, or serialized artifact is loaded, the embedded payload executes with the privileges of the user running the training/conversion job.
RemediationAI
Upgrade NVIDIA Megatron Bridge to the fixed version listed in NVIDIA's advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5841 - no exact fix version is provided in the input data, so the vendor advisory must be consulted (no vendor-released patch version independently confirmed at time of analysis). Until patched, restrict which users and processes can supply serialized inputs to Megatron Bridge: only load model checkpoints, configs, and serialized artifacts from trusted, integrity-verified sources, and treat third-party or downloaded checkpoints as untrusted code (trade-off: reduced convenience when consuming community model files). On shared or multi-tenant hosts, tighten filesystem permissions and run conversion/training jobs under least-privilege, isolated accounts or containers so code execution cannot escalate beyond the job's sandbox (trade-off: added operational overhead for job isolation). Where feasible, prefer safe serialization formats such as safetensors over pickle-backed loading to eliminate the deserialization code-execution path.
More in Megatron Bridge
View allArbitrary code execution in NVIDIA Megatron Bridge for Linux stems from improper control of code generation (CWE-94), al
Arbitrary code execution in NVIDIA Megatron Bridge (all versions per the NVIDIA advisory) arises from unsafe deserializa
Insecure deserialization in NVIDIA Megatron Bridge for Linux (CWE-502) lets an attacker who supplies a crafted serialize
Arbitrary code execution in NVIDIA Megatron Bridge on Linux arises from unsafe reflection (CWE-470), where externally-co
Deserialization of untrusted data in NVIDIA Megatron Bridge for Linux (CWE-502) can lead to arbitrary code execution, pr
Local code execution and privilege escalation in NVIDIA Megatron Bridge (Linux) stems from unsafe handling of dynamicall
Local privilege escalation and code execution in NVIDIA Megatron Bridge for Linux stems from unsafe deserialization of a
Arbitrary code execution in NVIDIA Megatron Bridge for Linux arises from unsafe deserialization of untrusted data (CWE-5
Arbitrary code execution and privilege escalation in NVIDIA Megatron Bridge on Linux arises from unsafe deserialization
Server-side request forgery in NVIDIA Megatron Bridge for Linux allows an attacker to coerce the software into issuing a
NVIDIA Megatron Bridge contains a vulnerability in a data shuffling tutorial, where malicious input could cause a code i
NVIDIA Megatron Bridge contains a vulnerability in a data merging tutorial, where malicious input could cause a code inj
Same weakness CWE-94 – Code Injection
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today