Executive brief
NVIDIA Transformers4Rec, a library used for building recommendation systems, contains a security flaw in how it processes data files. An attacker could use a specially crafted file to take control of the system, steal sensitive information, or modify data. This requires a user to interact with a malicious file on a Linux system where the software is installed.
Technical details
A deserialization vulnerability (CWE-502) exists in NVIDIA Transformers4Rec for Linux. The flaw stems from the improper handling of untrusted data during the deserialization process. An attacker can exploit this by providing a malicious input file, which, when processed by the library, allows for arbitrary code execution, unauthorized data modification, or information disclosure. The attack vector is local (AV:L) and requires user interaction (UI:R), typically involving the victim loading a malicious model or data file. The vulnerability has been assigned a CVSS v3.1 base score of 7.8.
Affected products
- NVIDIA Transformers4Rec Linux versions
Timeline
- 2026-05-26: disclosed: Initial publication of the CVE record.