EUVD-2026-69328
GHSA-cg8m-q29g-g493
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector and low-privilege requirement are consistent with a shared-node deserialization flaw; full C/I/A impact reflects arbitrary code execution potential.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
Articles & Coverage 2
AnalysisAI
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes local users to code execution, data tampering, and information disclosure. An attacker with low-privileged local access can supply crafted serialized payloads to the Bridge component, which are deserialized without adequate validation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an attacker to hold a low-privileged local account on the system running NVIDIA Megatron Bridge (CVSS PR:L, AV:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.8 (High) is driven by C:H/I:H/A:H with AV:L/AC:L/PR:L/UI:N, meaning an authenticated local attacker with minimal privileges can achieve full compromise of the affected process with no special conditions beyond local access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation step is to apply the vendor-supplied patch referenced in the NVIDIA PSIRT advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5868; however, an exact fixed version number is not present in the available intelligence and should be confirmed directly with NVIDIA before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
While no public exploit has been identified at time of analysis, the attack surface remains critical in multi-tenant environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Nemo Megatron Bridge
View allDeserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbit
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbit
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-privilege access to achieve
Local code execution in NVIDIA Megatron Bridge exploits unsafe deserialization of attacker-controlled data, allowing a l
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes affected systems to code execution, data tampering,
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a low-privileged local user to achieve arbitrary code
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbit
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local low-privileged attacker to achieve code exec
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes systems to local code execution, data tampering, and
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve code
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve full
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local low-privileged attacker to achieve arbitrary
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today