NVIDIA Model Optimizer ONNX Quantization Unsafe Deserialization Vulnerability Allowing Code Execution

A vulnerability exists in the ONNX quantization feature of NVIDIA Model Optimizer for Windows and Linux. This issue allows for unsafe deserialization by using a specially crafted input file. Exploiting this vulnerability could lead to code execution, escalation of privileges, data tampering, and information disclosure.

Impact

Successful exploitation may result in unauthorized code execution, elevated privileges, altered data, and leaked information.

Remediation

Users are advised to update to version 0.41.0 or later. The updated version is available on the NVIDIA GitHub page.