The vulnerability is a flaw in the inference logic of NVIDIA Megatron‑LM that permits an attacker to craft an input that, when processed, triggers execution of arbitrary code. This flaw is tied to deserialization of user input (CWE‑502). If exploited, the attacker can run arbitrary code, potentially escalating privileges, leaking sensitive data or altering model outputs.

All deployments of NVIDIA Megatron‑LM are potentially affected; the CNA does not list specific versions, so every instance of the inference component should be considered at risk until a vendor update is released.

The CVSS score of 7.8 indicates high severity. The EPSS score is below 1 %, suggesting that exploitation is currently unlikely, and the vulnerability is not listed in CISA’s KEV catalog. The path to exploitation is inferred: an attacker must persuade a user or otherwise deliver a maliciously crafted input to the inference service, implying a social‑engineering or compromised‑local‑access vector. With these conditions met, the vulnerability can result in remote code execution and associated impacts.