CVE-2026-53805
NVIDIA SIL GEN3C Unauthenticated RCE via Pickle Deserialization in Inference API
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code execution vulnerability in the inference API server where the /request-inference and /seed-model endpoints deserialize raw HTTP request bodies using Python's pickle.loads() without authentication or input validation. Attackers can supply a crafted payload containing a __reduce__ gadget to the inference API port to achieve remote code execution as the inference process.
| CWE | CWE-502 |
| Vendor | nv-tlabs |
| Product | gen3c |
| Published | Jun 17, 2026 |
| Last Updated | Jun 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for nv-tlabs gen3c
Be the first to know when new critical vulnerabilities affecting nv-tlabs gen3c are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
nv-tlabs / GEN3C
0 < db2ffe12ced12ddafcec5e0422ee46ce8520746b
References
github.com: https://github.com/nv-tlabs/GEN3C/pull/62 github.com: https://github.com/nv-tlabs/GEN3C/pull/63 github.com: https://github.com/nv-tlabs/GEN3C/commit/db2ffe12ced12ddafcec5e0422ee46ce8520746b vulncheck.com: https://www.vulncheck.com/advisories/nvidia-sil-gen3c-unauthenticated-rce-via-pickle-deserialization-in-inference-api
Credits
Valentin Lobstein (Chocapikk) VulnCheck