NVIDIA Megatron-LM CVE-2026-65180

Exploitation requires the victim to load an attacker-supplied, maliciously crafted checkpoint/model file into NVIDIA Megatron-LM; the vulnerable code path is the checkpoint-loading (deserialization) routine, so the attacker must first deliver the file and persuade the user to open it. Limiting factors: the vector is local (AV:L) rather than remote network, exploitation hinges on the user actually loading untrusted checkpoints (the CVSS UI:N label appears inconsistent with this described user-interaction requirement), and organizations that only load checkpoints from trusted/internal sources are not realistically exposed. No authentication bypass or network service is involved.

This is a CWE-502 unsafe deserialization flaw in NVIDIA Megatron-LM checkpoint loading, scored CVSS 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, yielding full confidentiality, integrity, and availability impact. The real-world risk is moderated by the attack vector: exploitation is local (AV:L) and, per the description, requires the attacker to convince a user to load a maliciously crafted checkpoint file - a social-engineering/supply-chain style precondition typical of pickle-deserialization bugs in ML frameworks. Note a conflict in the input signals: the CVSS vector lists UI:N (no user interaction) yet the description explicitly requires convincing a user to load a file, which implies user interaction (UI:R) - this should be verified with NVIDIA, as it materially affects exploitability. No EPSS score, CISA KEV listing, or POC indicator was provided, so there is no evidence of active exploitation or published exploit code; this is therefore a credible but not confirmed-exploited issue. Overall this is a genuine high-impact RCE class (deserialization-to-code-execution is reliably weaponizable once a victim loads the file), but it is not a drive-by remote network flaw - it depends on an attacker delivering a malicious model/checkpoint and a user loading it, so prioritization should weigh the organization's exposure to untrusted checkpoints over raw CVSS.

An attacker publishes or shares a malicious Megatron-LM checkpoint file (e.g., on a model hub, shared storage, or via a compromised supply-chain artifact) and convinces an ML engineer to load it for training or inference. When the victim loads the checkpoint, embedded serialized objects are deserialized and execute arbitrary code in the victim's context, leading to code execution, privilege escalation, information disclosure, and data tampering. No public exploit identified at time of analysis, though pickle-style deserialization flaws are generally straightforward to weaponize.