NVIDIA Megatron-LM CVE-2026-65110

Exploitation requires that a victim load an attacker-supplied, maliciously crafted Megatron-LM checkpoint file into the checkpoint-loading path, which deserializes untrusted data (CWE-502). The attack is local (AV:L) - the attacker does not reach the target over the network but must deliver the malicious artifact (e.g., via a model repository, shared filesystem, or social engineering) and induce the user to load it. Key limiting factors: the attack depends on victim action (loading the file), aligning with the description's 'convincing a user' even though the CVSS vector marks UI:N; it requires low-level privileges on the system (PR:L) and does not work against systems that never load untrusted checkpoints. Code executes with the privileges of the loading user/process, not inherently root.

This is a CWE-502 deserialization-to-RCE flaw in NVIDIA Megatron-LM checkpoint loading, scored CVSS 7.8 (High) by NVIDIA PSIRT. The signals point to meaningful-but-conditional risk rather than a drop-everything emergency. The CVSS vector is AV:L (local) and PR:L, meaning the attack is not a remote, network-facing vector - the malicious checkpoint must be loaded on the target system by a user with at least low privileges. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active or imminent mass exploitation; exploitation status is best described as no public exploit identified at time of analysis. There is a notable internal conflict: NVIDIA's vector sets UI:N (no user interaction), yet the description explicitly says the attack requires 'convincing a user to load a maliciously crafted file,' which is textbook user interaction - verify UI with the vendor, as this directly affects whether the flaw is treated as a social-engineering/supply-chain issue or an autonomous one. Overall this behaves like the broad class of 'malicious ML artifact' deserialization bugs (akin to unsafe pickle/torch.load loading): high technical impact (C:H/I:H/A:H, full code execution as the loading user) but gated behind the victim voluntarily loading an attacker-supplied file, which realistically means a targeted supply-chain or social-engineering delivery rather than opportunistic scanning.

An attacker publishes or shares a trojanized model checkpoint (e.g., via a model hub, shared storage, or a compromised artifact) and convinces an ML engineer to load it into a Megatron-LM training or inference workflow. When the victim loads the checkpoint, malicious serialized objects are deserialized (CWE-502), executing attacker code with the victim's privileges. No public exploit code is identified in the provided data, but the AV:L/AC:L profile makes successful exploitation straightforward once the victim loads the file.