CVE-2025-14924

[CVE catalog]

Severity

High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Published

Dec 23, 2025, 9:04:40 PM UTC

Updated

May 21, 2026, 3:00:32 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.33% · Oct 25, 2026

A flaw was found in the Hugging Face Transformers library. The parsing of checkpoints fails to validate user-supplied data, causing a deserialization of untrusted data. An attacker can exploit this issue by providing a malicious megatron_gpt2 model, resulting in arbitrary code execution in the context of the current process processing the file. transformers: code execution when processing a malicious megatron_gpt2 model file To exploit this issue, an attacker must convince a user to process a specially crafted megatron_gpt2 model file or visiting a malicious page, limiting the possibility of exploitation. Additionally, model files are not typically processed by users with administrative privileges, limiting the potential for a full system compromise. Due to these reasons, this vulnerability has been rated with an important severity. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.