Tencent PatrickStar CVE-2025-13706

Exploitation requires the victim to load attacker-supplied data through PatrickStar's merge_checkpoint endpoint - i.e., opening a malicious checkpoint/model file or visiting a page that triggers that load - which deserializes untrusted data (CWE-502). The limiting factors are mandatory user interaction (UI:R) and a local attack vector (AV:L): there is no remote, unauthenticated, network-triggerable path, so an attacker must socially engineer the target into processing the crafted file. No authentication is required of the attacker (PR:N), and successful exploitation yields code execution as root, but realistic risk is confined to environments where users ingest untrusted PatrickStar checkpoints.

Signals point to a genuine but non-urgent issue. The CVSS 3.0 base score of 7.8 (HIGH) is driven by severe impact (C:H/I:H/A:H, with code execution in the context of root per the ZDI advisory), but the vector itself tempers real-world urgency: AV:L means the attacker has no network path and AC:L/PR:N is offset by UI:R - a victim must actively open a malicious checkpoint file or visit a malicious page. The EPSS probability of 0.51% (42nd percentile) is low, there is no CISA KEV listing, and no public exploit was identified in the provided data, so there is no evidence of widespread or active exploitation. These signals are consistent rather than conflicting: a high-impact-but-user-interaction-gated deserialization bug in a niche ML library. One caveat to verify: the only linked 'fix' reference is a GitHub commit that merely relaxes requirements.txt version pins (torch/transformers) and does not visibly patch the deserialization path, so the actual remediation and fixed version are not confirmed from available data. Net: a real priority for the small population running PatrickStar with untrusted checkpoint inputs, but not a broad emergency.

An attacker crafts a malicious model checkpoint file and lures a PatrickStar user into loading it (e.g., sharing a 'pretrained' checkpoint or linking a malicious page). When the victim processes it through the merge_checkpoint endpoint, the untrusted data is deserialized and attacker-controlled code runs in the context of root. No public exploit was identified at time of analysis, though the root-level impact makes the technique attractive if weaponized.