CVE-2026-53805
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
An unauthenticated remote code execution vulnerability exists in NVIDIA SIL's GEN3C library. The /request-inference and /seed-model endpoints deserialize raw HTTP request bodies using pickle.loads() without authentication or input validation, allowing attackers to inject a crafted payload with a __reduce__ gadget.
Risk Assessment
An attacker can remotely execute arbitrary code in the inference process context, leading to full server compromise, data exfiltration, or denial of service.
Recommendation
Immediately update GEN3C to a version that replaces pickle with a safe serialization format (e.g., JSON) and adds authentication and input validation to inference endpoints.
Original NVD description (English source)
NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code execution vulnerability in the inference API server where the /request-inference and /seed-model endpoints deserialize raw HTTP request bodies using Python's pickle.loads() without authentication or input validation. Attackers can supply a crafted payload containing a __reduce__ gadget to the inference API port to achieve remote code execution as the inference process.