NVIDIA Megatron-LM EUVD-2026-98563

Exploitation requires a Megatron-LM deployment that uses the inference request cache, plus attacker ability to submit inference requests (PR:L - at least low-level/authenticated access to the inference endpoint). The core prerequisite is engineering inputs that collide under the weak hash (CWE-328) used as the cache key; this is reflected by AC:H and is the primary limiting factor. Exploitation is further bounded by the need for the caching mechanism to be active and for the attacker to share the cache with victim requests (the S:C/C:L/I:H impact only materializes against co-tenant/other users' cached data). It does not require user interaction (UI:N) and does not affect availability (A:N).

This is a moderate-severity issue (CVSS 7.1) that is unlikely to be a top-tier emergency priority. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N) indicates a network-reachable flaw but with meaningful friction: high attack complexity (AC:H) and a requirement for at least low-level privileges (PR:L) - i.e. the attacker must already be able to submit inference requests. The scope change (S:C) and high integrity impact (I:H) are what push the score up, reflecting that a successful hash collision in the shared inference cache can tamper with data served to other requests, with only limited (C:L) information disclosure. No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit identified at time of analysis, so there is no signal of active or widespread exploitation. The combination of CWE-328 (weak hash), AC:H, and the need to deliberately engineer collisions means exploitation is non-trivial and more consistent with a targeted, research-grade attack than opportunistic mass exploitation. Net: a legitimate issue to patch for anyone running Megatron-LM inference with caching, but not a drop-everything priority absent exploitation signals.

An attacker who can already submit inference requests to a Megatron-LM deployment crafts inputs engineered to collide under the weak hash used to key the inference cache. The collision causes cached results to be mismatched, letting the attacker tamper with data returned to other requests and glean partial information about other cached entries. No public proof-of-concept was identified, and the high attack complexity means the attacker must successfully engineer the collisions.