Which versions of NVIDIA GEN3C are affected by CVE-2026-53805?

NVIDIA's GEN3C inference API server contains a critical vulnerability enabling remote code execution without requiring authentication, directly threatening any organization that deploys this…. A patch is available.

How to fix or mitigate CVE-2026-53805?

Within 24 hours: Identify all GEN3C inference API instances in your environment and immediately restrict network access to the /request-inference and /seed-model endpoints from untrusted sources. Within 7 days: Apply the vendor-released patch from NVIDIA Spatial Intelligence Lab and verify successful deployment across all production and non-production systems. Within 30 days: Conduct a security audit of all inference API access controls and implement network segmentation to limit these endpoints to only authorized internal services.

NVIDIA GEN3C CVE-2026-53805

Q: What is the CVSS score of CVE-2026-53805?

CVE-2026-53805 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-17 VulnCheck

Nvidia Deserialization Python RCE Gen3C

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Network-reachable HTTP endpoint, no auth or user interaction, single crafted request triggers pickle deserialization yielding full code execution and complete confidentiality, integrity, and availability impact on the host process.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 17, 2026 - 18:01 vuln.today

Analysis Generated

Jun 17, 2026 - 18:01 vuln.today

DescriptionCVE.org

NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code execution vulnerability in the inference API server where the /request-inference and /seed-model endpoints deserialize raw HTTP request bodies using Python's pickle.loads() without authentication or input validation. Attackers can supply a crafted payload containing a __reduce__ gadget to the inference API port to achieve remote code execution as the inference process.

Articles & Coverage 1

News Critical RCE in NVIDIA GEN3C Inference API Server - CVE-2026-53805 Jun 17, 2026

AnalysisAI

Unauthenticated remote code execution in NVIDIA Spatial Intelligence Lab's GEN3C inference API server allows network attackers to execute arbitrary Python code by sending crafted pickle payloads to the /request-inference and /seed-model endpoints. The endpoints feed raw HTTP bodies directly into pickle.loads() with no authentication or validation, so a standard __reduce__ gadget yields code execution as the inference process. No public exploit identified at time of analysis, but the upstream patch and a VulnCheck advisory document the precise vulnerable code path.

Technical ContextAI

GEN3C is NVIDIA's generative 3D scene/video research project from the Spatial Intelligence Lab (nv-tlabs). Its GUI ships a Python-based inference API server that exchanges request dataclasses (InferenceRequest, SeedingRequest, CompressedSeedingRequest) between client and server. The root cause is CWE-502 (Deserialization of Untrusted Data): the server used pickle as its wire format, and pickle.loads() invokes object reconstruction callables, including those supplied via the __reduce__ protocol, allowing any pickled byte stream to execute arbitrary Python at load time. The fix replaces pickle with a new safe_serialization module that encodes payloads as safetensors with a JSON header restricted to an explicit allow-list of dataclasses, so an attacker can no longer smuggle an executable gadget. Affected CPE: cpe:2.3:a:nv-tlabs:gen3c:*:*:*:*:*:*:*:*.

RemediationAI

Upstream fix available (commit db2ffe12ced12ddafcec5e0422ee46ce8520746b in nv-tlabs/GEN3C via PRs #62 and #63); released patched version not independently confirmed, so users should pull the current main branch or cherry-pick that commit, which removes pickle.dumps/loads from gui/api/client.py and introduces gui/api/safe_serialization.py using safetensors plus an allow-listed JSON header. Until the fix is deployed, bind the inference API server strictly to localhost or a trusted management interface, place it behind a reverse proxy that enforces authentication, and use host firewall rules to block the inference port from untrusted networks; the trade-off is that any remote GUI clients will lose connectivity until tunneled through SSH or VPN. Do not attempt to filter the pickle payload at the application layer - pickle gadgets are trivially polymorphic and any allow/deny list of opcodes is unsafe. Refer to the VulnCheck advisory (https://www.vulncheck.com/advisories/nvidia-sil-gen3c-unauthenticated-rce-via-pickle-deserialization-in-inference-api) for upstream guidance.