The vulnerability in NVIDIA Megatron Bridge arises from an insecure deserialization routine that accepts untrusted data without proper validation. When a crafted serialized payload is processed, the component can instantiate arbitrary objects, which can lead to code execution, modification of data, and disclosure of sensitive information. The flaw is identified as CWE‑502 and may allow an attacker to take full control of the affected system.

The affected product is NVIDIA Megatron Bridge. No specific product version is listed in the advisory, so administrators should verify that all installed instances are updated to the newest release from NVIDIA. Administrators should also verify that only trusted hosts can communicate with the component. Until a fixed version is confirmed, any current or older releases may contain the flaw.

The advisory assigns a CVSS score of 7.8, indicating high severity. The EPSS score is not available, so the exploitation probability is not quantified, but the absence from the CISA KEV catalog suggests no known active attacks. The likely attack vector is the delivery of a malicious serialized payload over a network interface or any other interface that accepts external input; local exploitation is also possible if the component runs with elevated privileges.