EUVD-2026-41020
GHSA-5h5c-69mg-qp94
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local deserialization of shared artifacts needs an existing low-privilege foothold (AV:L, PR:L), triggers with no victim interaction (UI:N), and yields full code execution (C/I/A:H).
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dynamically managed code resources. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.
Articles & Coverage 1
AnalysisAI
Local code execution and privilege escalation in NVIDIA Megatron Bridge (Linux) stems from unsafe handling of dynamically managed code resources, rooted in an insecure deserialization flaw (CWE-502). A low-privileged local user who can influence the data or model artifacts Megatron Bridge loads can achieve arbitrary code execution, escalate privileges, tamper with data, and disclose information. NVIDIA self-reported the issue with a CVSS 3.1 base score of 7.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
NVIDIA Megatron Bridge is a Python-based framework that bridges NVIDIA's Megatron-LM large-language-model training stack with broader model tooling (checkpoint conversion, model/optimizer state interchange, and distributed training workflows). The affected component is identified by the CPE cpe:2.3:a:nvidia:megatron-bridge:*:*:*:*:*:*:*:*. The root-cause class is CWE-502 (Deserialization of Untrusted Data): frameworks in this space frequently rely on Python pickle-based serialization (e.g., torch.load / pickle for checkpoints and configuration objects), where deserializing an attacker-controlled artifact instantiates arbitrary objects and can invoke code during unpickling. NVIDIA's phrasing of 'improper control of dynamically managed code resources' aligns with deserialization that dynamically constructs and executes code paths from untrusted serialized input.
RemediationAI
Consult the NVIDIA product-security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5841 for the fixed release and upgrade Megatron Bridge to the vendor-patched version once identified; no exact fix version is provided in the input data, so treat 'Patch available per vendor advisory' as the status and verify the version directly from NVIDIA's advisory rather than assuming a number. Until patched, apply compensating controls: only load checkpoints, model weights, and configuration artifacts from trusted, integrity-verified sources (enforce checksums or signatures on artifacts), which prevents ingestion of attacker-planted payloads but adds provenance-tracking overhead; run training/inference jobs under dedicated least-privilege service accounts and containers so that deserialization-triggered code cannot escalate beyond a sandbox, at the cost of tighter isolation configuration; and restrict write access to shared checkpoint/model directories and artifact registries to trusted users, which blocks the local planting vector but may impede collaborative workflows. Where feasible, prefer safe serialization formats (e.g., safetensors) over pickle-based checkpoints for untrusted inputs.
More in Megatron Bridge
View allArbitrary code execution in NVIDIA Megatron Bridge for Linux stems from improper control of code generation (CWE-94), al
Arbitrary code execution in NVIDIA Megatron Bridge (all versions per the NVIDIA advisory) arises from unsafe deserializa
Insecure deserialization in NVIDIA Megatron Bridge for Linux (CWE-502) lets an attacker who supplies a crafted serialize
Arbitrary code execution in NVIDIA Megatron Bridge on Linux arises from unsafe reflection (CWE-470), where externally-co
Deserialization of untrusted data in NVIDIA Megatron Bridge for Linux (CWE-502) can lead to arbitrary code execution, pr
Deserialization of untrusted data in NVIDIA Megatron Bridge for Linux allows a low-privileged local attacker to achieve
Local privilege escalation and code execution in NVIDIA Megatron Bridge for Linux stems from unsafe deserialization of a
Arbitrary code execution in NVIDIA Megatron Bridge for Linux arises from unsafe deserialization of untrusted data (CWE-5
Arbitrary code execution and privilege escalation in NVIDIA Megatron Bridge on Linux arises from unsafe deserialization
Server-side request forgery in NVIDIA Megatron Bridge for Linux allows an attacker to coerce the software into issuing a
NVIDIA Megatron Bridge contains a vulnerability in a data shuffling tutorial, where malicious input could cause a code i
NVIDIA Megatron Bridge contains a vulnerability in a data merging tutorial, where malicious input could cause a code inj
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today