CVE-2026-65179: NVIDIA NeMo Pickle Deserialization RCE

CVE-2026-65179 Overview

NVIDIA NeMo contains an insecure deserialization vulnerability in the TabularTokenizer class. The affected code path calls pickle.load() on an attacker-controlled .pkl file without any validation of its contents. Because Python's pickle module can instantiate arbitrary objects and execute code during deserialization, loading a crafted file allows an attacker to run code inside the NeMo process.

Successful exploitation can lead to remote code execution, data tampering, denial of service, and information disclosure on hosts running the affected tokenizer. The weakness is tracked as CWE-502: Deserialization of Untrusted Data.

Critical Impact

An attacker who convinces a NeMo user or pipeline to load a malicious .pkl file achieves arbitrary code execution in the context of the NeMo process, exposing training data, model weights, and connected infrastructure.

Affected Products

• NVIDIA NeMo (versions containing the vulnerable TabularTokenizer deserialization path)
• NeMo-based training and inference pipelines that consume external .pkl tokenizer artifacts
• Downstream projects and containers that embed the vulnerable NeMo component

Discovery Timeline

• 2026-09-22 - CVE-2026-65179 published to NVD
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-65179

Vulnerability Analysis

The vulnerability sits in the TabularTokenizer class in NVIDIA NeMo. When the tokenizer is initialized or restored from disk, it reads a serialized state file and passes the file handle directly to pickle.load(). No integrity check, signature verification, or safe-loader wrapper is applied to the input.

Python's pickle protocol reconstructs objects by invoking their __reduce__ methods, which can return callables and arguments that Python then executes. A crafted .pkl file can therefore invoke os.system, subprocess.Popen, or any importable callable during load. The result is arbitrary code execution inside the process that instantiated the tokenizer.

Because NeMo is commonly executed inside training clusters, GPU workstations, and CI pipelines, the compromised process often has access to model weights, datasets, cloud credentials, and shared storage. This expands the blast radius beyond a single host.

Root Cause

The root cause is trust placed in an external serialized artifact. pickle.load() is not a parser; it is an interpreter for a bytecode-like format that permits object construction with side effects. Using it on files that can be supplied or replaced by an attacker is unsafe by design and is the canonical example of [CWE-502].

Attack Vector

Exploitation requires the victim to load an attacker-controlled .pkl file with the vulnerable TabularTokenizer. Delivery paths include shared model repositories, community-published tokenizer artifacts, compromised object storage buckets, poisoned training datasets, and supply-chain substitutions in Git or artifact registries. The user interaction requirement is satisfied when an engineer or automated pipeline points NeMo at the malicious file.

No authentic exploit code is published in the referenced advisories. See the NVIDIA product security advisory for vendor technical details.

Detection Methods for CVE-2026-65179

Indicators of Compromise

• Unexpected child processes spawned by Python interpreters running NeMo, such as shells, curl, wget, or package managers launched immediately after tokenizer initialization.
• .pkl files appearing in tokenizer or dataset directories from untrusted sources or with recent modification times that do not match the deployment change log.
• Outbound network connections from training or inference hosts to unknown destinations shortly after model or tokenizer load.

Detection Strategies

• Monitor Python process ancestry for pickle.load call paths that precede execution of system utilities or interpreters.
• Hash and inventory all .pkl artifacts consumed by NeMo pipelines and alert on files that deviate from an approved allow-list.
• Instrument NeMo entry points to log the full filesystem path and origin of any tokenizer artifact loaded at runtime.

Monitoring Recommendations

• Enable command-line and process-tree telemetry on all GPU and ML training hosts, including containers, so deserialization-triggered execution is visible.
• Track file writes to model, dataset, and tokenizer directories and correlate them with authorized CI/CD job identifiers.
• Alert on new outbound connections from workloads that historically communicated only with internal artifact stores.

How to Mitigate CVE-2026-65179

Immediate Actions Required

• Upgrade NVIDIA NeMo to the fixed version identified in the NVIDIA product security advisory.
• Audit all .pkl tokenizer artifacts currently in use and remove any file whose provenance cannot be verified.
• Restrict write access to tokenizer, model, and dataset directories to trusted build systems and named service accounts.
• Isolate NeMo training and inference workloads with least-privilege credentials so a compromised process cannot pivot to cloud APIs or shared storage.

Patch Information

Refer to the vendor advisory at NVIDIA product-security repository, entry 5885 for the specific fixed versions and upgrade instructions. Additional record data is available in the NVD entry for CVE-2026-65179 and the CVE.org record.

Workarounds

• Do not load .pkl tokenizer files from untrusted sources, including public model hubs, shared drives, and email attachments.
• Where feasible, convert tokenizer artifacts to safer formats such as JSON or safetensors and remove pickle-based loaders from the pipeline.
• Execute NeMo workloads inside sandboxed containers with no outbound internet access and read-only mounts for model directories.
• Enforce cryptographic signing of tokenizer artifacts and verify signatures before invoking any deserialization routine.

# Configuration example: verify tokenizer artifacts before use
sha256sum -c tokenizer.pkl.sha256 || { echo "Integrity check failed"; exit 1; }