CVE-2026-53805

Summary

NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code execution vulnerability in the inference API server where the /request-inference and /seed-model endpoints deserialize raw HTTP request bodies using Python's pickle.loads() without authentication or input validation. Attackers can supply a crafted payload containing a reduce gadget to the inference API port to achieve remote code execution as the inference process.

Affected Software

VendorProductVersion RangeStatus
nv-tlabsGEN3C0 < db2ffe12ced12ddafcec5e0422ee46ce8520746baffected

Weaknesses

  • CWE-502: Deserialization of Untrusted Data

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: total

References