Nemo Speech
Monthly
Code execution, data tampering, denial of service, and information disclosure are all reachable in NVIDIA NeMo Speech 0.0 through 2.9 because its TabularTokenizer class deserializes attacker-supplied .pkl artifacts through pickle.load() with no validation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) marks this as unauthenticated but user-interaction-gated: nothing executes until a NeMo user obtains and loads the malicious tokenizer or model file, so the attack depends on a social-engineering or supply-chain delivery step rather than a directly triggerable remote request. Impact is rated high across all three security properties, but no public exploit code was identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status; realistic exposure is further narrowed by the research and development orientation of the affected toolkit.
Code execution, data tampering, denial of service, and information disclosure in NVIDIA NeMo Speech (versions 0.0 through 2.9) stem from unsafe deserialization of parameters injected through a maliciously crafted model_config.yaml handled by the dataset-loading workflow. The issue is locally scoped: the assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:R with a base score of 7.8, meaning an attacker with low privileges must place the crafted config where the victim or an automated pipeline will parse it - for example inside a shared or downloaded model bundle or dataset - and exploitation depends on that untrusted NeMo config being loaded. There is no remote network-service exposure, and no public exploit identified at time of analysis; the CVE is not listed in CISA KEV.
Code injection in NVIDIA NeMo Speech versions 0.0 through 2.9 allows local attackers with low privileges to execute arbitrary code, disclose sensitive information, and tamper with data by supplying crafted input to the toolkit. The vulnerability requires local access (AV:L) and low privileges (PR:L) but no user interaction; it has a CVSS 3.1 base score of 7.8 (High) and is classified as CWE-77 (command injection). No public exploit code has been identified at time of analysis, and the vendor advisory at GitHub NVIDIA product-security 2026/5885 should be consulted for patch details.
Code execution, information disclosure, and data tampering are possible in NVIDIA NeMo Speech versions 0.0 through 2.9 due to unsafe deserialization of untrusted data. Exploitation requires the victim to load attacker-crafted serialized data (dataset, manifest, or model checkpoint) on their own machine, making this a local, user-interaction-dependent flaw (AV:L/UI:R) that runs with the victim's privileges. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Deserialization of untrusted data in the NVIDIA NeMo Speech 'Speech Data Explorer' component (affected versions 0.0 through 2.9, all platforms) lets an attacker who supplies crafted malicious data achieve code execution in the context of the user running the tool, with follow-on privilege escalation, information disclosure, and data tampering. The flaw requires no authentication on the target (PR:N) but is local in reach (AV:L) and depends on user interaction (UI:R) - a user must actively open or load the attacker-crafted dataset, manifest, or serialized artifact inside the Explorer, which confines exposure to developers and researchers running NeMo rather than production network services. No public exploit code was identified at time of analysis, there is no confirmed active exploitation (the CVE is not in CISA KEV), and the CVSS 3.1 base score is 7.8 (CWE-502).
Code execution, data tampering, denial of service, and information disclosure are all reachable in NVIDIA NeMo Speech 0.0 through 2.9 because its TabularTokenizer class deserializes attacker-supplied .pkl artifacts through pickle.load() with no validation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) marks this as unauthenticated but user-interaction-gated: nothing executes until a NeMo user obtains and loads the malicious tokenizer or model file, so the attack depends on a social-engineering or supply-chain delivery step rather than a directly triggerable remote request. Impact is rated high across all three security properties, but no public exploit code was identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status; realistic exposure is further narrowed by the research and development orientation of the affected toolkit.
Code execution, data tampering, denial of service, and information disclosure in NVIDIA NeMo Speech (versions 0.0 through 2.9) stem from unsafe deserialization of parameters injected through a maliciously crafted model_config.yaml handled by the dataset-loading workflow. The issue is locally scoped: the assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:R with a base score of 7.8, meaning an attacker with low privileges must place the crafted config where the victim or an automated pipeline will parse it - for example inside a shared or downloaded model bundle or dataset - and exploitation depends on that untrusted NeMo config being loaded. There is no remote network-service exposure, and no public exploit identified at time of analysis; the CVE is not listed in CISA KEV.
Code injection in NVIDIA NeMo Speech versions 0.0 through 2.9 allows local attackers with low privileges to execute arbitrary code, disclose sensitive information, and tamper with data by supplying crafted input to the toolkit. The vulnerability requires local access (AV:L) and low privileges (PR:L) but no user interaction; it has a CVSS 3.1 base score of 7.8 (High) and is classified as CWE-77 (command injection). No public exploit code has been identified at time of analysis, and the vendor advisory at GitHub NVIDIA product-security 2026/5885 should be consulted for patch details.
Code execution, information disclosure, and data tampering are possible in NVIDIA NeMo Speech versions 0.0 through 2.9 due to unsafe deserialization of untrusted data. Exploitation requires the victim to load attacker-crafted serialized data (dataset, manifest, or model checkpoint) on their own machine, making this a local, user-interaction-dependent flaw (AV:L/UI:R) that runs with the victim's privileges. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Deserialization of untrusted data in the NVIDIA NeMo Speech 'Speech Data Explorer' component (affected versions 0.0 through 2.9, all platforms) lets an attacker who supplies crafted malicious data achieve code execution in the context of the user running the tool, with follow-on privilege escalation, information disclosure, and data tampering. The flaw requires no authentication on the target (PR:N) but is local in reach (AV:L) and depends on user interaction (UI:R) - a user must actively open or load the attacker-crafted dataset, manifest, or serialized artifact inside the Explorer, which confines exposure to developers and researchers running NeMo rather than production network services. No public exploit code was identified at time of analysis, there is no confirmed active exploitation (the CVE is not in CISA KEV), and the CVSS 3.1 base score is 7.8 (CWE-502).