NVIDIA Megatron Bridge incorporates a deserialization flaw where an attacker can supply untrusted data for processing. If exploitation succeeds, the attacker may gain code execution privileges, tamper with data, or expose sensitive information. The weakness is identified as CWE-502, indicating an unsafe practices in handling serialized objects that can lead to arbitrary code execution.

The affected product is NVIDIA Megatron Bridge. Specific version details are not disclosed in the available data. Users should verify the build of their bridge deployment against NVIDIA’s product security advisories for confirmation of exposure.

The vulnerability carries a CVSS score of 7.8, signifying a high risk to affected systems. EPSS information is not available, and the issue is not listed in the CISA KEV catalog at this time. Based on the description, the likely attack vector is the delivery of malicious serialized payloads to any component of the bridge that processes external input. An attacker with network reachability or local access to the deserialization interface could leverage this weakness to execute arbitrary code or modify data. The exploit would require crafting a payload that triggers the unsafe deserialization path; no additional authentication obstacles are described.