A flaw in NVIDIA’s Megatron Bridge permits the forced deserialization of data from untrusted sources, which can lead to code execution, data tampering, and the disclosure of sensitive information. The weakness is a classic deserialization vulnerability that allows an attacker to control the objects processed by the bridge, thereby compromising the confidentiality, integrity, and availability of the system in any context where the bridge accepts external input.

The product impacted is NVIDIA Megatron Bridge. No specific product versions are listed in the advisory, meaning that all deployments of this component should be evaluated for risk. Operators should check where Megatron Bridge is used and verify whether untrusted data streams may reach it.

The CVSS score of 7.8 indicates high severity, but no EPSS value is available, so the exploitation probability is not quantified. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an attacker who can send crafted serialized objects to the bridge—such as a compromised client or another service that communicates with it. Since the flaw requires the bridge to accept untrusted data, the exploitation path involves dispatching malicious payloads that trigger arbitrary code execution upon deserialization, thereby compromising the system’s confidentiality, integrity, and availability.