A flaw in NVIDIA NeMo Framework allows an attacker to trigger remote code execution by delivering malicious input. The vulnerability is categorized as CWE-502 (Deserialization of Untrusted Data) and can lead to code execution, privilege escalation, information disclosure, and data tampering. Successful exploitation would compromise the integrity and availability of the affected system, potentially allowing full system compromise.

The vulnerability affects NVIDIA NeMo Framework. No specific version range is provided in the CNA data, so all releases of the framework are potentially at risk until an official patch or upgrade is applied.

The flaw carries a CVSS score of 7.8, indicating high impact. EPSS shows a probability of less than 1 % for exploitation in the wild, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is remote, where an attacker sends crafted input to the framework over a network or through a local interface. No additional exploitation prerequisites are described in the entry.