CVE-2025-14920

[CVE catalog]

Severity

High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Published

Dec 23, 2025, 9:04:36 PM UTC

Updated

May 21, 2026, 3:00:32 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.36% · Oct 25, 2026

A flaw was found in the Hugging Face Transformers library. The parsing of model files fails to validate user-supplied data, causing a deserialization of untrusted data. An attacker can exploit this issue by providing a malicious Perceiver model or convincing a user to visit a malicious page, resulting in arbitrary code execution in the context of the current process. transformers: code execution when processing a malicious Perceiver model file To exploit this issue, an attacker must convince a user to process a specially crafted Perceiver model file or visiting a malicious page, limiting the possibility of exploitation. Additionally, model files are not typically processed by users with administrative privileges, limiting the potential for a full system compromise. Due to these reasons, this vulnerability has been rated with an important severity. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.