CVE-2026-65142: NVIDIA Model-Optimizer RCE Vulnerability

CVE-2026-65142 Overview

CVE-2026-65142 is an insecure deserialization vulnerability [CWE-502] in NVIDIA Model-Optimizer. An attacker can supply crafted serialized data that the application deserializes without validation. Successful exploitation can lead to code execution, data tampering, denial of service, and information disclosure on the affected host.

The flaw requires local access and user interaction, which limits remote exploitation but places risk on workflows that load untrusted model artifacts. Confidentiality, integrity, and availability are all affected when exploitation succeeds.

Critical Impact
Attackers who convince a user to open a malicious serialized object can execute arbitrary code in the context of the Model-Optimizer process, tamper with model data, or disrupt optimization workloads.

Affected Products

NVIDIA Model-Optimizer (specific affected versions listed in the NVIDIA security advisory)

Discovery Timeline

2026-10-06 - CVE-2026-65142 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-65142

Vulnerability Analysis

The vulnerability stems from unsafe deserialization of attacker-controlled input within NVIDIA Model-Optimizer. Deserialization routines reconstruct in-memory objects from a serialized byte stream. When the stream is not validated, embedded gadget chains or class constructors can execute during object reconstruction.

In machine learning tooling, this risk is common because model files, checkpoints, and configuration artifacts are frequently exchanged between users. A single malicious artifact loaded into Model-Optimizer can trigger arbitrary code execution with the privileges of the invoking user.

The attack is local and requires user interaction, meaning a victim must open or import the crafted file. Impact spans confidentiality, integrity, and availability.

Root Cause

The root cause is improper handling of untrusted serialized data, classified as [CWE-502] Deserialization of Untrusted Data. The deserialization routine instantiates objects without verifying the type, source, or integrity of the serialized payload. This permits execution of attacker-defined logic through object constructors, reducer methods, or callbacks invoked during unpickling.

Attack Vector

An attacker crafts a malicious serialized object, such as a tampered model checkpoint or configuration file, and distributes it through a shared repository, email, or model hub. A user running NVIDIA Model-Optimizer imports the file, and the deserialization routine executes the embedded payload. The payload runs with the user's privileges and can install persistence, exfiltrate data, modify models, or terminate running processes.

No exploit code is public at the time of publication. Detailed technical specifics are available in the NVIDIA Product Security Advisory.

Detection Methods for CVE-2026-65142

Indicators of Compromise

Unexpected child processes spawned by the Model-Optimizer Python interpreter, such as shells, curl, wget, or script hosts.
Model artifacts (.pkl, .pt, .ckpt, or similar) loaded from untrusted sources immediately preceding anomalous process activity.
Outbound network connections from ML workstations to unfamiliar hosts shortly after model import.

Detection Strategies

Hunt for process lineage where Python or Model-Optimizer binaries invoke command interpreters or networking utilities.
Monitor file system events for creation of persistence artifacts (cron jobs, systemd units, startup scripts) by the ML tooling process.
Inspect model artifacts for pickle opcodes such as REDUCE, GLOBAL, or BUILD referencing os, subprocess, or builtins.

Monitoring Recommendations

Enable detailed process and command-line auditing on hosts running NVIDIA Model-Optimizer.
Centralize endpoint telemetry and model-loading events into a SIEM for correlation across ML workloads.
Alert on first-seen executions originating from Python environments used for model optimization.

How to Mitigate CVE-2026-65142

Immediate Actions Required

Upgrade NVIDIA Model-Optimizer to the fixed version listed in the NVIDIA Product Security Advisory.
Restrict Model-Optimizer usage to trusted model artifacts obtained from verified internal sources.
Revoke and rotate credentials present on any host that loaded a suspicious model file.

Patch Information

NVIDIA has published remediation guidance in bulletin 2026/5903. Review the NVIDIA Product Security Advisory for the specific fixed version and upgrade instructions. Additional record details are available at the NVD entry for CVE-2026-65142 and the CVE.org record.

Workarounds

Load only model files from internal, cryptographically verified sources until patching is complete.
Run Model-Optimizer under a dedicated low-privilege account to limit the blast radius of code execution.
Isolate ML development hosts on segmented networks that restrict outbound traffic to approved destinations.

bash

# Example: verify integrity of model artifacts before loading
sha256sum model.ckpt | diff - trusted_hashes.txt