CVE-2026-53805 describes a critical remote code execution vulnerability in the nv-tlabs GEN3C inference API server. The vulnerability arises because the /request-inference and /seed-model endpoints deserialize untrusted input using Python's pickle.loads() without any authentication or input validation. An attacker can exploit this by sending a malicious payload containing a __reduce__ gadget to achieve remote code execution within the inference process. The vulnerability is unauthenticated and remotely exploitable, with no known exploits in the wild and no vendor-provided patch or remediation at this time.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code on the inference API server process, potentially compromising the system running GEN3C. This can lead to full system compromise depending on the privileges of the inference process. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting network access to the inference API endpoints and monitor for suspicious activity. Avoid exposing the vulnerable endpoints to untrusted networks. No official remediation or temporary fix is currently documented.