Hugging Face Transformers CVE-2025-14930

Exploitation requires the victim to load an attacker-supplied, malicious GLM4 model/weights file using Hugging Face Transformers (version 4.57.1 per CPE); the vulnerable code path is the parsing/deserialization of model weights. Limiting factors: the CVSS vector is LOCAL (AV:L) and mandates user interaction (UI:R) - there is no remotely reachable attack surface, so an attacker cannot trigger it without the victim opening/loading the crafted file or visiting a malicious page that causes a load. No authentication or special privileges are needed (PR:N), and no non-default configuration is called out, so any workflow that loads untrusted/third-party models is exposed; environments that only load trusted, locally-produced weights are not realistically reachable.

This is a genuine high-severity flaw (CVSS 7.8, CVSS:3.0/AV:L/AC:L/PR:N/UI:R) but the real-world risk signals point to opportunistic, not mass, exploitation. The vector is explicitly LOCAL (AV:L) with required user interaction (UI:R): despite the title calling it 'Remote Code Execution' and the description saying 'remote attackers', actual code execution requires the victim to load/open an attacker-supplied malicious model file - this is the standard ZDI file-format framing where 'remote' means remote delivery, not a remotely reachable listener. No privileges are needed (PR:N) and complexity is low (AC:L), so once a malicious weights file is opened, exploitation is reliable. Exploitation probability is low: EPSS is 0.33% (25th percentile), there is NO CISA KEV listing, and NO public exploit code is referenced - only a ZDI advisory. The signals are internally consistent (low EPSS + no KEV + user-interaction requirement all agree this is not wormable/mass-exploited). Priority should be driven by exposure to untrusted model files (the AI/ML supply-chain threat model), not by raw CVSS. Note: the CVSS vector is CVSS:3.0, not 3.1, and the input provides no SSVC decision data, so automatable/technical-impact framework inputs are absent.

An attacker publishes a malicious GLM4 model (crafted weights file) to a model hub or sends it directly to a victim. When a developer or ML pipeline loads the model with Hugging Face Transformers, the untrusted data is deserialized (CWE-502) and attacker-controlled code executes in the context of the loading process. No public exploit code is identified at time of analysis, and user interaction (loading the file) is required.