NVIDIA Megatron Bridge is vulnerable to unintended deserialization of untrusted data, a weakness that allows an attacker to inject malicious payloads during object reconstruction. The CVE description states that a successful exploit could lead to code execution, data tampering, and information disclosure. This aligns with CWE‑502, which is an input payload tampering vulnerability that lets attackers modify data structures in memory at runtime, giving them high control over system behavior.

The affected product is NVIDIA Megatron Bridge from NVIDIA. No specific version ranges are listed in the available data, so all deployed instances should be treated as vulnerable until a patched release is confirmed.

The CVSS score of 7.8 classifies this issue as high severity, indicating significant potential impact. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, so there is no current evidence of widespread exploitation. Nevertheless, because the flaw permits code execution through deserialization of data that the bridge accepts over the network or from external interfaces, the attack vector is likely remote and could be triggered by a malicious network actor or a compromised client. The path to exploitation requires that the attacker be able to supply crafted input to the bridge, making network isolation or input validation crucial for mitigation.