NVIDIA NeMo Speech contains a deserialization of untrusted data vulnerability (CWE-502) in its speech data explorer component. This flaw allows an attacker who can supply maliciously crafted data to potentially execute arbitrary code remotely. The CVSS 3.1 score is 7.8 (high), with attack vector local, low attack complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation could result in remote code execution, escalation of privileges, disclosure of sensitive information, and tampering with data within the affected component. The attack requires local access and user interaction, limiting the attack surface somewhat but still posing a significant risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, avoid processing untrusted speech data with the speech data explorer component and limit user access to trusted sources only.