EUVD-2026-41019
GHSA-qhf9-p9vv-vgj2
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Deserialization is reachable only locally with existing low privileges (AV:L/PR:L), triggers without interaction (AC:L/UI:N), and yields full code execution giving high C/I/A within an unchanged scope.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper validation of allowed inputs. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.
Articles & Coverage 1
AnalysisAI
Local privilege escalation and code execution in NVIDIA Megatron Bridge for Linux stems from unsafe deserialization of attacker-controlled input (CWE-502), allowing a low-privileged local user to achieve arbitrary code execution, tamper with data, and disclose information. NVIDIA reported the flaw with no public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was provided. Megatron Bridge is an ML/LLM training framework, so impact centers on shared GPU/training hosts rather than internet-facing services.
Technical ContextAI
Megatron Bridge is NVIDIA's bridging library within the Megatron ecosystem, used to connect model/checkpoint and configuration state for large-language-model training on Linux GPU hosts. The root cause is CWE-502 (Deserialization of Untrusted Data): the code deserializes inputs - typically model checkpoints, configuration blobs, or serialized Python objects (e.g. pickle-backed artifacts common in ML tooling) - without adequately validating that the input is trusted or well-formed. Because Python deserialization can instantiate arbitrary objects and invoke callables during unpickling, an attacker who supplies a crafted artifact can direct execution flow, which the vendor maps to code execution, privilege escalation, data tampering, and information disclosure. The affected component is identified by CPE cpe:2.3:a:nvidia:megatron-bridge:*:*:*:*:*:*:*:* (all versions until the fixed release).
RemediationAI
Patch available per vendor advisory: upgrade NVIDIA Megatron Bridge to the fixed release referenced in NVIDIA's product-security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5841 (consult that advisory for the exact patched version, which was not included in this dataset). Until patched, restrict who can supply model checkpoints, configuration files, and other serialized artifacts to Megatron Bridge, and load artifacts only from trusted, integrity-verified sources - treat third-party or downloaded checkpoints as untrusted, since loading them is the exploitation path and blocking untrusted artifacts is the most effective compensating control, at the cost of workflow friction. Run training jobs under least-privilege accounts and isolate them (dedicated users, containers, or namespaces) so that successful code execution cannot escalate beyond the training context, accepting added operational overhead. Where feasible, prefer safe serialization formats (e.g. safetensors) over pickle-based deserialization for model weights to shrink the attack surface.
More in Megatron Bridge
View allArbitrary code execution in NVIDIA Megatron Bridge for Linux stems from improper control of code generation (CWE-94), al
Arbitrary code execution in NVIDIA Megatron Bridge (all versions per the NVIDIA advisory) arises from unsafe deserializa
Insecure deserialization in NVIDIA Megatron Bridge for Linux (CWE-502) lets an attacker who supplies a crafted serialize
Arbitrary code execution in NVIDIA Megatron Bridge on Linux arises from unsafe reflection (CWE-470), where externally-co
Deserialization of untrusted data in NVIDIA Megatron Bridge for Linux (CWE-502) can lead to arbitrary code execution, pr
Deserialization of untrusted data in NVIDIA Megatron Bridge for Linux allows a low-privileged local attacker to achieve
Local code execution and privilege escalation in NVIDIA Megatron Bridge (Linux) stems from unsafe handling of dynamicall
Arbitrary code execution in NVIDIA Megatron Bridge for Linux arises from unsafe deserialization of untrusted data (CWE-5
Arbitrary code execution and privilege escalation in NVIDIA Megatron Bridge on Linux arises from unsafe deserialization
Server-side request forgery in NVIDIA Megatron Bridge for Linux allows an attacker to coerce the software into issuing a
NVIDIA Megatron Bridge contains a vulnerability in a data shuffling tutorial, where malicious input could cause a code i
NVIDIA Megatron Bridge contains a vulnerability in a data merging tutorial, where malicious input could cause a code inj
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today