CVE-2026-65178
Received Received - Intake

NVIDIA NeMo Unsafe Parameter Injection Vulnerability

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: NVIDIA Corporation

Description
NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model_config.yaml can inject unsafe parameters. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-65178
EUVD
EUVD-2026-84405

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nvidia nemo *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

NVIDIA NeMo has a vulnerability where a maliciously crafted model_config.yaml file can inject unsafe parameters during dataset loading. This may allow attackers to execute arbitrary code, tamper with data, cause denial of service, or disclose sensitive information.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized code execution on your system, allowing attackers to take control. It may also result in data tampering, service disruption, or exposure of confidential information stored or processed by NeMo.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Review and validate all model_config.yaml files in your NVIDIA NeMo deployment to ensure no unsafe parameters are injected. Update NeMo to the latest patched version if available. Restrict access to NeMo configuration files and directories to authorized personnel only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65178. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart