Is CVE-2026-53805 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53805 being exploited in the wild.

How severe is CVE-2026-53805?

Critical severity, with a CVSS score of 9.8, published 17 June 2026.

Which products and versions are affected?

Nvidia GEN3C versions before commit db2ffe12ced12ddafcec5e0422ee46ce8520746b.

Is there a fix for CVE-2026-53805?

A patch was published on 2026-06-15: Official patch committed to main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53805 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-53805?

Check whether you run Nvidia GEN3C at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53805: NVIDIA GEN3C remote code execution in inference API server

CVE-2026-53805 · Severity: critical · CVSS 9.8 · Published 2026-06-17

NVIDIA GEN3C is a research project from the Spatial Intelligence Lab used for 3D generative modeling. A security flaw in its inference server allows an unauthenticated attacker to remotely execute commands on the host system. This could lead to a complete takeover of the server, theft of proprietary AI models, or unauthorized access to sensitive data processed by the application.

Vendors: Nvidia.

Quick answers

Is CVE-2026-53805 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53805 being exploited in the wild.
How severe is CVE-2026-53805?: Critical severity, with a CVSS score of 9.8, published 17 June 2026.
Which products and versions are affected?: Nvidia GEN3C versions before commit db2ffe12ced12ddafcec5e0422ee46ce8520746b.
Is there a fix for CVE-2026-53805?: A patch was published on 2026-06-15: Official patch committed to main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53805 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-53805?: Check whether you run Nvidia GEN3C at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The NVIDIA Spatial Intelligence Lab (SIL) GEN3C inference API server is vulnerable to unauthenticated remote code execution (RCE). The root cause is the use of Python's 'pickle.loads()' to deserialize raw HTTP request bodies at the '/request-inference' and '/seed-model' endpoints without prior authentication or input validation. An attacker can exploit this by sending a specially crafted HTTP POST request containing a malicious '__reduce__' gadget. Successful exploitation allows the attacker to execute arbitrary code with the privileges of the inference process. The vulnerability was addressed by replacing pickle-based deserialization with a safer 'safetensors' and JSON-based codec in commit db2ffe1.

Affected products

NVIDIA GEN3C versions before commit db2ffe12ced12ddafcec5e0422ee46ce8520746b

Timeline

2026-06-11: disclosed: Initial fix proposed via community pull request
2026-06-15: patched: Official patch committed to main branch
2026-06-17: advisory: NVD and VulnCheck advisories published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.