CVE-2026-65178

Analyzed Analyzed - Analysis Complete

NVIDIA NeMo Unsafe Parameter Injection Vulnerability

Publication date: 2026-09-22

Last updated on: 2026-09-29

Assigner: NVIDIA Corporation

Description

NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model_config.yaml can inject unsafe parameters. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-29

Generated

2026-10-12

AI Q&A

2026-09-22

EPSS Evaluated

2026-10-11

NVD

CVE-2026-65178

EUVD

EUVD-2026-84405

Affected Vendors & Products

Vendor	Product	Version / Range
nvidia	nemo_speech	to 3.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

NVIDIA NeMo has a vulnerability where a maliciously crafted model_config.yaml file can inject unsafe parameters during dataset loading. This may allow attackers to execute arbitrary code, tamper with data, cause denial of service, or disclose sensitive information.

Detection Guidance

Detection involves inspecting NeMo configurations for unsafe parameters in model_config.yaml. Check for unexpected YAML keys or values, especially those related to code execution or file operations. Review logs for anomalies during dataset loading.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized code execution on your system, allowing attackers to take control. It may also result in data tampering, service disruption, or exposure of confidential information stored or processed by NeMo.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Review and validate all model_config.yaml files in your NVIDIA NeMo deployment to ensure no unsafe parameters are injected. Update NeMo to the latest patched version if available. Restrict access to NeMo configuration files and directories to authorized personnel only.

Hi! I’m here to help you understand CVE-2026-65178. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70