Technical impact
NVIDIA FLARE SDK contains a flaw in the FOBS component that allows an attacker to send a maliciously crafted FOBS-encoded message. The SDK will deserialize the data without proper validation, which can trigger arbitrary code execution. The vulnerability is a classic case of Deserialization of Untrusted Data (CWE-502), and a successful exploit could compromise the confidentiality, integrity, and availability of the affected system.
Affected Systems
All installations of NVIDIA FLARE SDK are potentially affected. The exact version numbers that contain the flaw are not specified, so every deployed instance should be considered at risk until a vendor patch is released.
Risk and Exploitability
The CVSS score of 8.8 indicates a high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Although the input does not state the attack vector, the description of a message that can be sent suggests that the exploit can be performed remotely over a network connection to a system running FLARE SDK. Given the risk rating and the lack of an official patch at this time, the potential for exploitation remains significant.
