CVE-2026-65179

Executive Summary

CVE-2026-65179 is an insecure deserialization vulnerability (CWE-502) in NVIDIA NeMo's TabularTokenizer class, which loads an untrusted, attacker-controlled .pkl file through pickle.load() without validation. Any user or pipeline that processes an attacker-supplied pickle artifact (for example, an "innocent" tokenizer file received from an external collaborator, model hub, or dataset) can trigger arbitrary code execution, data tampering, denial of service, and information disclosure on the host. With a CVSS base score of 8.8 and High integrity/availability/confidentiality impact, this is a high-severity risk for ML engineering, data-science, and MLOps environments that routinely consume third-party model or tokenizer artifacts.

Technical Analysis

The vulnerability resides in NVIDIA NeMo's TabularTokenizer class, which deserializes a .pkl file via Python's pickle.load() without validating the origin or content of that file. Python's pickle module is not a safe data format: deserialization executes code through the __reduce__/__setstate__ mechanisms. Any attacker who can control the .pkl file consumed by TabularTokenizer can therefore achieve arbitrary code execution in the process that loads it, with the privileges of the loading user or service.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H maps to the following characteristics:

• Attack Vector: Network (N) — the malicious .pkl file can be delivered remotely (download, shared storage, repository, or model hub).
• Attack Complexity: Low (L) — no special conditions or race windows are required; a crafted pickle is sufficient.
• Privileges Required: None (N) — the attacker needs no prior access to the target.
• User Interaction: Required (R) — a victim must load or process the malicious artifact through the vulnerable tokenizer.
• Scope: Unchanged (U) — the impact is confined to the vulnerable component's security authority.
• Confidentiality/Integrity/Availability: High (H/H/H) — full range of impact: information disclosure, data tampering, and denial of service.

The attack surface is any code path, notebook, script, or MLOps pipeline that instantiates or uses TabularTokenizer against external data. Because the description explicitly names pickle.load() as the deserialization primitive, the exploitable condition is the deserialization of an untrusted pickle, not a parsing flaw in the tabular data itself. No CNA title was provided, and no further code-level detail (parameter names, endpoint, file paths) is available in the supplied data; statements beyond the mechanism described above would be speculation and are intentionally omitted.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code is available for CVE-2026-65179. The chain below is inferred from the vulnerability class (CWE-502, insecure deserialization) and the NVD description.

1. Reconnaissance / target identification. The adversary identifies an ML or data team that uses NVIDIA NeMo for tabular data processing and that ingests tokenizer artifacts from outside the trusted boundary — e.g., via a shared model repository, dataset delivery, or an "internal" file share. The relevant reference point is any workflow that feeds a .pkl file into TabularTokenizer.

2. Trigger of the specific flaw class. The attacker crafts or replaces the .pkl artifact with a malicious pickle. When the victim's code invokes the vulnerable TabularTokenizer path, pickle.load() is called on the attacker-controlled file. Because pickled payloads can encode arbitrary callables, the act of deserialization executes attacker-chosen code — this is the deserialization sink, not a downstream logic error.

3. Payload / execution method (class level). At the vulnerability-class level, the attacker exploits the fact that Python pickle deserialization executes instructions during loading. The payload is embedded in the .pkl file and runs as soon as the file is deserialized by TabularTokenizer. No condition beyond successful deserialization is required (AC:L, PR:N), but the victim must cause that deserialization to occur (UI:R).

4. Post-exploitation impact. With code execution inside the deserializing process, the attacker can read sensitive files and training data (information disclosure), modify or corrupt tokenizer/model artifacts and downstream outputs (data tampering), and terminate or resource-starve the running process or pipeline (denial of service). Those impacts map directly to the High C/I/A subscores in the CVSS vector. The absence of a public PoC means exploitation currently requires the attacker to develop a custom payload, but the underlying technique is well understood and low in complexity.

Impact Assessment

Business impact. Compromise of an ML host or pipeline can expose proprietary datasets, model weights, credentials, and infrastructure secrets reused across the environment. Because deserialization executes in-process, the attacker inherits the trust and network position of the victim process — often a development or training job with broad data access. Corruption of tokenizers or artifacts can silently degrade model behavior, producing integrity failures that are difficult to detect.

Affected systems. Any deployment running NVIDIA NeMo with the affected TabularTokenizer class, particularly environments that load .pkl artifacts from external or semi-trusted sources (model hubs, shared drives, third-party data vendors, or CI/CD artifact stores).

Blast radius. Scope is Unchanged (U), so the immediate CVSS impact is confined to the vulnerable component; however, executed code can pivot inside the host or connected services — the CVSS scope metric does not cap real-world lateral movement. No affected version list or OSV package data was provided, so the precise vulnerable version range cannot be asserted with confidence.

Exploitability. 8.8 High with AC:L, PR:N, UI:R — high raw exploitability when the victim is induced to load the file. No EPSS score is available yet (not scored by FIRST.org) and no CISA KEV listing exists, so active exploitation cannot be confirmed.

Detection Guidance

Sigma Rule

title: Insecure Deserialization via NVIDIA NeMo TabularTokenizer Pickle Load
id: 9f2c8a41-4d3b-4e77-9c1a-6b2e8f0a1c5d
status: experimental
description: Detects suspicious pickle file access consistent with CVE-2026-65179 exploitation, where an untrusted .pkl is deserialized by TabularTokenizer.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-65179
author: Valters IT Threat Intelligence
date: 2026/04/14
logsource:
  category: file_event
  product: linux
detection:
  selection_ext:
    TargetFilename|endswith:
      - '.pkl'
      - '.pickle'
  selection_context:
    Image|contains:
      - 'python'
      - 'jupyter'
  selection_path:
    TargetFilename|contains:
      - 'nemo'
      - 'tokenizer'
      - '/tmp/'
      - '/dev/shm/'
  condition: selection_ext and selection_context and selection_path
fields:
  - TargetFilename
  - Image
  - User
falsepositives:
  - Legitimate model or tokenizer deployments from trusted internal registries
  - Data-science users loading self-authored pickle artifacts
level: medium

YARA Rule

rule CVE_2026_65179_Pickle_Deserialization
{
    meta:
        description = "Detects Python pickle payloads with code-execution opcodes (REDUCE/GLOBAL) potentially targeting NVIDIA NeMo TabularTokenizer"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-65179"
        cve = "CVE-2026-65179"
        author = "Valters IT Threat Intelligence"
        date = "2026-04-14"
        severity = "high"

    strings:
        $pickle_magic = { 80 04 95 }
        $pickle_proto0 = { 28 64 70 }        // "(dp" protocol 0
        $op_global   = { 63 }                 // 'c' GLOBAL
        $op_reduce   = { 52 }                 // 'R' REDUCE
        $op_builtins = "builtins" ascii
        $op_os       = "posix" ascii
        $op_rundef   = "\nR" ascii
        $op_stack    = "system" ascii
        $op_eval     = "eval" ascii
        $op_exec     = "exec" ascii

    condition:
        (
            $pickle_magic at 0 or $pickle_proto0
        ) and
        (
            (2 of ($op_global, $op_reduce, $op_rundef)) and
            (2 of ($op_builtins, $op_os, $op_stack, $op_eval, $op_exec))
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-65179 Possible NVIDIA NeMo Malicious Pickle Download (.pkl)"; flow:established,to_client; file_data; content:"|80 04 95|"; depth:0; content:"c"; distance:0; content:"R"; distance:0; flowbits:set,pickle_seen; fileext:"pkl"; classtype:attempted-user; sid:2026651790; rev:1; reference:cve,2026-65179; metadata:affected_product "NVIDIA NeMo", deployment Perimeter;)

Elastic Detection

file where process.executable != null and
  file.name : ("*.pkl", "*.pickle") and
  file.path : ("*nemo*", "*tokenizer*", "/tmp/*", "/dev/shm/*") and
  process.name : ("python", "python3", "jupyter", "jupyter-lab", "ipython")

Splunk SPL Query

index=endpoint OR index=edr (EventType=11 OR event_category="file")
| search (TargetFilename="*.pkl" OR TargetFilename="*.pickle")
| search (TargetFilename="*nemo*" OR TargetFilename="*tokenizer*" OR TargetFilename="/tmp/*" OR TargetFilename="/dev/shm/*")
| search (Image="*python*" OR Image="*jupyter*")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(TargetFilename) as files values(Image) as procs values(User) as users
        by ComputerName
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="nemo,pickle,deserialization,">
  <rule id="2026651" level="10">
    <if_sid>550</if_sid>
    <field name="file">\.pkl$|\.pickle$</field>
    <description>CVE-2026-65179: Suspicious pickle artifact (.pkl/.pickle) created or modified — possible NVIDIA NeMo TabularTokenizer deserialization activity.</description>
    <group>cve_2026_65179,deserialization,</group>
    <mitre>
      <id>T1204.002</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list was provided. Treat this as an open exposure until NVIDIA publishes an advisory or fix.

1) Immediate mitigations

• Do not load .pkl / .pickle artifacts obtained from untrusted or unverified sources into NeMo tooling.
• Enforce integrity controls on tokenizer/model artifacts: signed manifests, cryptographic hashes, and a vetted internal artifact registry before any deserialization occurs.
• Isolate ML workloads that must consume pickle artifacts in containers or sandboxes with least-privilege filesystem and network egress restrictions.
• Restrict write access to shared drives, model hubs, and dataset drop locations to reduce the opportunity to tamper with .pkl files.
• Treat all externally received tokenizer artifacts as hostile until validated through a trusted, non-pickled channel.

2) Patch / upgrade steps

• Monitor the NVIDIA product security page and the NVD entry for CVE-2026-65179 for an official fixed release or advisory.
• No fixed version is currently identified; do not assume partial mitigations are sufficient.
• When a patch is released, validate the artifact-loading path resolves to the corrected TabularTokenizer implementation before redeploying pipelines.

3) Long-term hardening

• Replace pickle-based artifact serialization with safe formats (e.g., safetensors, JSON, or other non-executable encodings) wherever feasible.
• Implement application-layer safeguards that restrict pickle deserialization to trusted, validated inputs — e.g., allowlisting module classes via a restricted unpickler.
• Add CI/CD gates that scan downloaded model and tokenizer artifacts for pickle opcode signatures before admission into production pipelines.
• Apply least privilege to all ML training and inference services, and monitor pickle file access with the detection content provided above.

References

• NVD — CVE-2026-65179: https://nvd.nist.gov/vuln/detail/CVE-2026-65179
• CWE-502: Deserialization of Untrusted Data — https://cwe.mitre.org/data/definitions/502.html
• Python Software Foundation — pickle module documentation and security considerations — https://docs.python.org/3/library/pickle.html
• NVIDIA Product Security Incident Response Team (PSIRT) advisories — https://www.nvidia.com/en-us/security/
• MITRE ATT&CK T1204.002 — User Execution: Malicious File — https://attack.mitre.org/techniques/T1204/002/

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-65179 in the provided data. CISA KEV status: not listed. No public PoC, Nuclei template, or exploit code is currently available.