NVIDIA NeMo's TabularTokenizer class performs pickle.load() on user‑supplied .pkl files without any validation, creating an insecure deserialization flaw (CWE‑502). The vulnerability allows an attacker to execute arbitrary code, tamper with data, cause a denial‑of‑service, or disclose sensitive information whenever the tokenizer processes a malicious pickle file.

All versions of NVIDIA NeMo Speech that include the TabularTokenizer component are affected. No specific version range is listed, so any release that still calls pickle.load() on untrusted data should be considered vulnerable.

The CVSS base score of 8.8 indicates a high‑severity vulnerability. No EPSS score is available, so the current exploitation probability remains uncertain. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires an attacker to supply a crafted .pkl file to the tokenizer—this can occur if the application accepts user‑controlled pickle files or exposes the tokenizer through a public API. Once the payload is deserialized, arbitrary code can run in the context of the NeMo process.