The NVIDIA BioNeMo Framework for Linux contains a deserialization vulnerability (CWE-502) where untrusted data can be deserialized, potentially leading to remote code execution, denial of service, information disclosure, and data tampering. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. The attack vector is local with low complexity and no privileges required, but user interaction is necessary. No patch or official remediation level has been disclosed by NVIDIA as of the publication date.

Successful exploitation can result in full compromise of the affected system's confidentiality, integrity, and availability, including arbitrary code execution, denial of service conditions, unauthorized information disclosure, and data manipulation. The vulnerability requires local access and user interaction, limiting remote exploitation but still posing a significant risk to local users or processes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit local access to trusted users and avoid processing untrusted serialized data with the BioNeMo Framework. Monitor NVIDIA's advisories for updates on patches or mitigations.