Hugging Face Accelerate
CVE-2025-14925
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious checkpoint file
-
DeliveryDeliver via model hub or malicious page
-
ExploitVictim loads untrusted checkpoint
-
ExecutionDeserialization of untrusted data triggered
-
ImpactExecute arbitrary code in process context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load or open an attacker-supplied Accelerate checkpoint file - the specific vulnerable feature is Accelerate's checkpoint parsing, which deserializes untrusted data without proper validation (CWE-502). The limiting factors are significant: AV:L means the malicious file/page must reach the target locally, and UI:R means a user (or an automated pipeline) must actively load the malicious checkpoint; there is no remote network-service trigger. No authentication is required (PR:N), and no special non-default configuration is indicated - any workflow that loads third-party or untrusted checkpoints is exposed. Environments that only load self-produced, trusted checkpoints are effectively not at risk. |
| Impact | This is a genuine but conditional risk rather than a drop-everything emergency. The CVSS 3.0 base score of 7.8 (HIGH) is driven by full technical impact (C:H/I:H/A:H) from arbitrary code execution via CWE-502 insecure deserialization, but the attack vector is LOCAL (AV:L) and requires user interaction (UI:R), which meaningfully constrains real-world exploitability. There is a notable tension between the prose and the vector: the description labels this a 'Remote Code Execution' flaw allowing 'remote attackers', yet the CVSS vector is AV:L/UI:R - this is the standard ZDI file-parsing pattern where delivery is remote (a malicious checkpoint file or page) but execution is local and victim-triggered, so it should be treated as a weaponized-malicious-file issue, not a remotely-reachable network service flaw. EPSS is low at 0.37% (29th percentile), the CVE is NOT on the CISA KEV list, and no public exploit code is referenced - consistent signals pointing to no current widespread exploitation. There is no SSVC decision data in the input. Net: a credible, reproducible RCE (ZDI-validated) in a popular ML library, but gated behind social-engineering/user-interaction, so it is a patch-on-normal-cycle priority for most, elevated for teams that routinely load third-party model checkpoints. |
| Exploit ScenarioDerived | An attacker crafts a malicious Hugging Face Accelerate checkpoint file embedding a serialized payload and distributes it via a model hub, download link, or malicious web page. A developer or ML pipeline loads the untrusted checkpoint, triggering deserialization of the attacker-controlled data (CWE-502) and executing arbitrary code in the context of the loading process. No public proof-of-concept is referenced, but ZDI independently validated the flaw (ZDI-CAN-27985), and the local AV:L/UI:R vector means the victim must actively open or load the file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Deserialization of untrusted data in Hugging Face Accelerate's checkpoint parsing allows arbitrary code execution in the context of the current process when a user or automated pipeline loads a malicious checkpoint file. The CVSS:3.0 vector (AV:L/AC:L/PR:N/UI:R) means the attacker must get the file to the target locally and the victim must actively load it - there is no remote network-service trigger - so environments that only load self-produced, trusted checkpoints are not at risk. No public exploit code or active exploitation is identified in the available intelligence, and EPSS is low at 0.37% (29th percentile); risk is genuine but conditional on loading third-party or untrusted checkpoints.
RemediationAI
No vendor-released patch or fixed version is identified in the available intelligence, so treat this as unpatched and mitigate by control: load checkpoints only from trusted, internally produced or cryptographically verified sources, and treat any externally sourced checkpoint as executable code. Where third-party checkpoints must be consumed, restrict what Accelerate deserializes - prefer safetensors or other non-executable serialization formats over pickle-based checkpoints, and inspect or convert files in an isolated sandbox before loading them in a production environment; the trade-off is conversion effort and possible loss of fidelity for checkpoints containing custom objects. Run checkpoint-loading workflows with least privilege and in containers or sandboxes with no access to sensitive credentials or network egress, which limits blast radius if a malicious file is opened but does not prevent the deserialization itself. Enforce human review gatekeeping for checkpoints pulled into automated pipelines, since UI:R means an automated load satisfies the interaction requirement, and monitor https://www.zerodayinitiative.com/advisories/ZDI-25-1140/ plus Hugging Face release channels for an upstream fix.
Affected ProductsAI
Hugging Face Accelerate installations whose checkpoint parsing handles untrusted files are affected; the description does not enumerate specific version ranges, and no CPE strings were provided in the available intelligence. The practical exposure set is any Accelerate-based training or inference workflow - including automated pipelines - that loads checkpoints obtained from third parties, model hubs, shared storage, or other untrusted sources. Environments restricted to self-produced, internally trusted checkpoints fall outside the effective risk boundary. Consult the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-25-1140/ for the vendor-reported affected versions and any confirmation from Hugging Face.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Hugging Face Accelerate is a PyTorch utility library that handles device placement, distributed training, and checkpoint saving/loading across model workflows. The flaw is CWE-502 (Deserialization of Untrusted Data): Accelerate's checkpoint parsing path deserializes attacker-controlled data without adequate validation, so a crafted checkpoint can instantiate arbitrary objects and execute code. Because checkpoint files are commonly traded and downloaded from model hubs, shared drives, and third-party sources, the trust boundary is the checkpoint file itself rather than the network. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - local attack vector, low complexity, no privileges required, but mandatory user interaction - reflecting that the payload only fires when the checkpoint is loaded. Origin: ZDI-CAN-27985, reported via Trend Micro's Zero Day Initiative; CPE data was not supplied in the available intelligence.
Know when Hugging Face gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-borne deserialization requires the victim to load a malicious checkpoint, so AV:L and UI:R with PR:N; arbitrary code execution yields full C:H/I:H/A:H.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
Hugging Face Accelerate Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Accelerate. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27985.
Executive ViewAI
Hugging Face Accelerate's checkpoint handling exposes organizations that load external model artifacts to arbitrary code execution on the machine running the pipeline. This creates a supply-chain risk for data science teams and shared ML infrastructure, with potential exposure of model intellectual property, training data, and credentials. Leadership should care because the exploit path is conditional but realistic wherever third-party checkpoints are used, and no vendor-released patch has been identified at time of analysis.
No vendor-released patch identified at time of analysis; interim mitigations include enforcing trusted-only checkpoint loading, verifying checkpoint integrity via signatures or SHA-256 hashes, sandboxing or containerizing checkpoint parsing with least privilege, restricting credentials and network access on ML hosts, scanning and quarantining untrusted checkpoints, and monitoring for anomalous process execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Hugging Face
View allDeserialization of untrusted data in Hugging Face Diffusers' CogView4 checkpoint-parsing path lets an attacker who suppl
Arbitrary code execution in Hugging Face Transformers 4.55.0 occurs when the library parses an attacker-supplied megatro
GitHub PoC
Exploit-DB