CVE-2026-15531 describes a deserialization vulnerability in the HashNeRF-pytorch project by yashbhalgat. The issue is located in the Checkpoint File Handler component, specifically in the torch.load function within run_nerf.py. Manipulating the ckpt_path argument can lead to unsafe deserialization. Exploitation requires local access, and no user interaction is needed. The product follows a rolling release model, so no fixed or affected versions are explicitly stated. A patch is pending acceptance, and no official remediation is currently available.

An attacker with local access can manipulate the checkpoint file path to cause unsafe deserialization, potentially leading to arbitrary code execution or other impacts associated with deserialization vulnerabilities. The CVSS 4.8 score indicates a medium severity impact with low attack complexity and no user interaction required. However, the attack vector is local, limiting remote exploitation.

No official fix or patch is currently available as the pull request to address this vulnerability is awaiting acceptance. Users should monitor the vendor's repository for the acceptance of the fix and apply updates promptly once available. Until then, restrict local access to trusted users only and avoid loading checkpoint files from untrusted sources.