datasets library CVE-2026-57225

Exploitation requires that the target application use the affected 'datasets' library to load or parse an NDJSON file whose content or structure is 'unexpected' (the exact trigger condition is not defined in available data). The attacker must be able to supply or influence the NDJSON file consumed by the library - either by placing a crafted file in a directory the application reads, uploading it through an intake endpoint, or contributing it to a dataset repository. Standard Python exception handling does NOT prevent the crash because NULL dereferences in native C extensions bypass Python-level try/except. Deployments that only process internally generated, trusted NDJSON files are not realistically at risk.

Risk signals are sparse: no CVSS vector, no CWE, no EPSS score, no KEV listing, and no POC have been recorded. The practical impact is almost certainly limited to availability (process crash / DoS) - NULL dereferences rarely yield code execution in modern memory-safe Python environments, as the interpreter traps the signal rather than allowing shellcode. Real-world risk depends heavily on context: if the library is used in a long-running data-ingestion service that accepts externally sourced NDJSON files, an attacker who can supply a crafted file can repeatedly crash the worker. In offline/batch ML training pipelines with controlled datasets, the risk is minimal. The absence of any CVSS, CWE, or KEV data means severity cannot be independently verified from NVD; all assessment here is inferred from the description alone.

An attacker who can influence the NDJSON files consumed by a data pipeline - for example by contributing a malformed dataset to a shared repository or uploading a crafted file to a self-hosted ingestion endpoint - submits a file containing structurally unexpected NDJSON content. When the datasets library attempts to parse the file, it dereferences a NULL pointer, crashing the Python process and interrupting the pipeline or service. No public exploit code exists at time of analysis.