Hugging Face Diffusers CVE-2025-14922

Exploitation requires the victim to load an attacker-supplied, untrusted model checkpoint through Hugging Face Diffusers' CogView4 checkpoint-parsing path, or to visit a malicious page / open a malicious file that triggers that loading (UI:R confirmed in the CVSS vector). The specific prerequisite is the processing of a crafted serialized checkpoint whose contents are not properly validated before deserialization (CWE-502). Limiting factors: the attack vector is LOCAL (AV:L), not a remotely reachable service, and mandatory user interaction is required - there is no unattended, network-triggered path. Risk is therefore concentrated in workflows that routinely ingest third-party or community-sourced model weights; environments that load only trusted, self-produced checkpoints face substantially lower practical exposure.

Signals are consistent and point to a genuine but condition-gated code-execution risk rather than an internet-wormable emergency. The CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 High) is the key discriminator: despite being described as 'Remote Code Execution,' the attack vector is LOCAL and requires user interaction (UI:R) - the victim must load a malicious checkpoint file or visit a malicious page, so this is not a direct remote-service exploit. EPSS is low at 0.37% (29th percentile), consistent with no active exploitation. The vulnerability is NOT on CISA KEV, and no public POC is referenced - only the ZDI advisory (ZDI-25-1142), so exploitation status is 'no public exploit identified at time of analysis.' The 'RCE' label plus AV:L is a common point of confusion: the title implies remote reach but the CVSS correctly models this as a local/file-borne deserialization bug (CWE-502), which in practice means social-engineering a user into loading an untrusted model checkpoint. Net: a real priority for anyone who loads third-party model weights, but not a drop-everything network-exposure crisis - the low EPSS and absence of KEV/POC support treating it as patch-in-normal-cycle unless you handle untrusted checkpoints routinely.

An attacker publishes a malicious CogView4 checkpoint to a model-sharing hub or sends it directly, and a user loads it with Hugging Face Diffusers; the crafted serialized data triggers unsafe deserialization during checkpoint parsing and executes attacker-controlled code in the context of the user's process. No public POC is referenced, and because the CVSS vector is AV:L with UI:R, exploitation depends on convincing the victim to open the malicious file rather than on any network-facing service.