Executive brief
NVIDIA NeMo Speech, a speech processing framework used for audio AI applications, contains a vulnerability that allows attackers to execute arbitrary code by providing malicious data. This could enable complete system compromise, including unauthorized access to sensitive audio data and deployment of malware or ransomware on affected systems.
Technical details
NeMo Speech processes user-supplied data without adequate validation, allowing deserialization or parsing of malicious payloads to achieve remote code execution. The vulnerability affects all platforms and can be triggered by providing crafted input to the framework. A successful exploit grants the attacker code execution with the privileges of the NeMo Speech application process.
Affected products
- NVIDIA NeMo Speech all platforms
Timeline
- 2026-09-22: disclosed