CVE-2025-13707: Tencent HunyuanDiT model_resume Deserialization of Untrusted Data Remote Code Execution Vulnerability
Tencent HunyuanDiT modelresume Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent HunyuanDiT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the modelresume function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27183.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13707?
CVE-2025-13707 is classified as a critical vulnerability allowing remote code execution on Tencent HunyuanDiT.
How do I fix CVE-2025-13707?
To fix CVE-2025-13707, users should update Tencent HunyuanDiT to the latest version provided by Tencent.
What impact does CVE-2025-13707 have on affected systems?
CVE-2025-13707 allows remote attackers to execute arbitrary code, potentially compromising entire systems.
Is user interaction required to exploit CVE-2025-13707?
Yes, user interaction is required to successfully exploit CVE-2025-13707.
What software is affected by CVE-2025-13707?
CVE-2025-13707 affects installations of Tencent HunyuanDiT.