Hugging Face Transformers CVE-2025-14924

Exploitation requires the victim to load/parse an attacker-controlled model checkpoint for the megatron_gpt2 model using Hugging Face Transformers (confirmed affected: version 4.55.0). The specific trigger is the checkpoint-parsing code path, which deserializes user-supplied data without proper validation (CWE-502). LIMITING FACTORS: the CVSS vector is AV:L with UI:R, meaning the attack is not remotely triggerable without victim action - a user must actively open the malicious file or visit a page that causes the checkpoint to be loaded. Code executes only with the privileges of the loading process/user (PR:N reflects no pre-authentication to the app, not elevated rights gained). This confines realistic risk to workflows that ingest untrusted third-party checkpoints.

This is a genuine but second-tier priority. The CVSS 3.0 base score of 7.8 is driven by a LOCAL attack vector (AV:L) combined with required user interaction (UI:R) and high confidentiality, integrity, and availability impact (C:H/I:H/A:H) with no privileges required (PR:N) and low complexity (AC:L). Critically, this is NOT a remotely-triggerable network flaw despite the 'Remote Code Execution' naming - the AV:L vector means exploitation requires the victim to locally load/parse an attacker-supplied checkpoint file. The EPSS score of 0.33% (25th percentile) is low, indicating low statistical likelihood of mass exploitation in the near term, which is consistent with the fact that there is no public exploit identified and the CVE is NOT on the CISA KEV list. These signals are internally consistent: a file-borne deserialization bug requiring user interaction is a targeted/social-engineering vector rather than a wormable, internet-facing one. One nuance worth flagging: the description uses the phrase 'remote attackers' and 'visit a malicious page,' yet the CVSS vector is AV:L - this reflects the ZDI convention where opening a malicious file counts as local even if the file is delivered over the network. No SSVC decision data was provided in the input. Overall: real and dangerous for environments that ingest third-party model checkpoints, but not a drop-everything internet-facing emergency.

An attacker publishes a trojanized model checkpoint on a model-sharing hub or sends it directly to a victim (e.g., a data scientist). When the victim loads the megatron_gpt2 checkpoint using Hugging Face Transformers, the embedded untrusted serialized payload is deserialized without validation (CWE-502), executing arbitrary code in the context of the user's process. No public exploit code has been identified at time of analysis, but the technique (malicious pickle/checkpoint deserialization) is well understood in the ML security community.