CVE-2026-78683 — CVSS 9.6 CRITICAL Severity | NVD Vulnerability Record

Executive Summary

A critical remote code execution vulnerability (CVE‑2026‑78683) exists in NLTK versions ≤ 3.9.4 due to unsafe pickle deserialization in the TransitionParser.parse() method. Any application that loads untrusted NLTK model files on any operating system is at risk, affecting developers, data‑science pipelines, and downstream services that embed NLTK. Immediate decision required: approve and deploy the NLTK 3.10.0 patch or implement strict model‑validation controls before any model is loaded.

Verified Facts

• NLTK ≤ 3.9.4 contains an unsafe pickle deserialization vulnerability in TransitionParser.parse() — Article.
• The vulnerable method calls pickle_load() with restricted=False, using WarningUnpickler that does not override find_class() — Article.
• Loading an attacker‑crafted model file can execute arbitrary Python code with the privileges of the running user — Article.
• NLTK provides a RestrictedUnpickler for safe deserialization, but it is not used in production code paths — Article.
• The vulnerability is fixed in NLTK 3.10.0 — Article.
• CVSS 3.1 score is 9.6 (Critical) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H — Article.
• Associated CWE is CWE‑502 (Deserialization of Untrusted Data) — Article.

Threat Classification

Threat type: Remote Code Execution via unsafe deserialization (HIGH CONFIDENCE). Affected sectors: any industry that incorporates NLTK for natural‑language processing, including finance, healthcare, technology, and academia (MEDIUM CONFIDENCE). Geographic scope: Global, as NLTK is distributed worldwide (HIGH CONFIDENCE). Exploitation status: The vulnerability is publicly documented and exploitable in theory; no public exploit disclosed (MEDIUM CONFIDENCE). Attacker motivation: Not specified in the source (LOW CONFIDENCE).

Threat Severity Assessment

Severity: CRITICAL

• Exploitability: Network‑reachable, no authentication, low complexity (HIGH CONFIDENCE).
• Impact: Complete confidentiality, integrity, and availability compromise (C:H/I:H/A:H) (HIGH CONFIDENCE).
• Prevalence: NLTK is a core dependency in thousands of Python projects (MEDIUM CONFIDENCE).
• CVSS score of 9.6 reinforces critical classification (HIGH CONFIDENCE).

Business Impact

• Operational disruption: A malicious model file could terminate or hijack data‑science pipelines, causing downtime of AI services and loss of processing throughput.
• Regulatory liability: If the executed payload exfiltrates personal data, GDPR fines may reach €20 million or 4 % of annual turnover; NIS2 or DORA penalties could apply to critical infrastructure operators.
• Financial exposure: High – remediation may require emergency patching, code review, and incident response resources.
• Reputational damage: Public disclosure of compromised AI models can erode client trust in the organization’s data‑science capabilities.

Technical Analysis

• Attack vector: Network‑delivered malicious NLTK model file (pickle) loaded by vulnerable application.
• Exploitation chain: Attacker crafts pickle gadget → Victim application calls TransitionParser.parse() → pickle_load(restricted=False) uses WarningUnpickler → Arbitrary class resolution → Execution of attacker‑controlled Python code.
• Affected component: nltk/parse/transitionparser.py in NLTK ≤ 3.9.4.
• Root cause: Unsafe deserialization of untrusted data (CWE‑502).
• CVSS vector: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (CVSS 3.1).
• Patch status: Fixed in NLTK 3.10.0; no mitigation in earlier releases.

CVE Analysis

• CVE‑2026‑78683 — NLTK ≤ 3.9.4 — CWE‑502 (Deserialization of Untrusted Data) — Network‑based attack, no authentication required, user‑interaction required (malicious model file) — Patch available in NLTK 3.10.0.

MITRE ATT&CK Mapping

• Execution → T1203: Exploitation for Client Execution — The vulnerable pickle_load() call enables execution of attacker‑controlled Python code when a malicious model file is loaded.

IOC Intelligence

No public IOCs confirmed at time of publication.

Behavioral IOC categories for rule creation:

• Python processes invoking pickle_load with restricted=False.
• File reads of .pickle or .pkl model files from directories not owned by the application.
• Creation of child processes shortly after loading an NLTK model file.
• Outbound network connections initiated by a Python process that recently loaded an NLTK model.

Detection Engineering Guidance

• Log source: Sysmon (Event ID 1 – Process Creation). Detect python.exe or python3 with command‑line arguments containing pickle_load or TransitionParser.parse.
• Log source: Sysmon (Event ID 10 – File Creation). Alert on creation of temporary files in %TEMP% or /tmp with .pkl/.pickle extensions that are subsequently read by a Python process.
• Log source: Windows Security (Event ID 4688) or Linux auditd (EXECVE). Correlate process start of python with a parent process that is a known NLTK‑using service.
• Telemetry field: command line, parent process ID, file path, hash of loaded model file. Flag when the hash is unknown to the trusted model repository.
• Rationale: The vulnerability is triggered only when a Python application loads a malicious pickle via the vulnerable method; monitoring these specific calls isolates the attack surface.

Sigma Rules

title: NLTK Unsafe Deserialization Execution
id: 3f9c2d1e-8b4a-4f6e-9c3a-2d5e7b9a1c4f
status: stable
description: Detects Python processes that invoke pickle_load with restricted=False, indicative of CVE‑2026‑78683 exploitation.
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 1
        Image|endswith: '\python.exe'
        CommandLine|contains|all:
            - 'pickle_load'
            - 'restricted=False'
    condition: selection

🔗 Related Intelligence Reports

• Related topic: CVE-2026-71914 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-71921 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-71933 — CVSS 9.1 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-76835 — CVSS 9.1 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-76071 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record