The NVIDIA BioNeMo Framework suffers from deserialization of untrusted data, which can allow an attacker to execute arbitrary code, cause a denial of service, disclose information, and tamper with data.

Vulnerable systems include NVIDIA BioNeMo Framework, with no specific version list available in the advisory.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the near term. The issue is not yet listed in the CISA KEV catalog. The most likely attack vector involves delivering malicious serialized input to the framework; details on whether this requires local or remote access are not provided, so an inference is that any component that handles external serialized data could be a target.