CVE-2026-53805 describes a critical vulnerability in nv-tlabs GEN3C where the inference API server endpoints /request-inference and /seed-model deserialize untrusted data using Python's pickle.loads() without authentication or validation. This unsafe deserialization enables unauthenticated attackers to achieve remote code execution by supplying a malicious payload containing a __reduce__ gadget. The vulnerability affects the inference process directly and does not require user interaction or privileges. The CVSS 4.0 base score is 9.3, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the product is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the inference API server process, potentially leading to full compromise of the affected system. This impacts confidentiality, integrity, and availability of the system running GEN3C. The vulnerability is critical due to its unauthenticated remote code execution nature and the lack of input validation on deserialization.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting network access to the inference API endpoints and avoid exposing them to untrusted networks. Implementing network-level controls or application-layer filtering to block or validate incoming requests may reduce risk. Monitor vendor communications for updates on patches or official mitigations.