CVE-2026-65110: High severity Nvidia Megatron-LM vulnerability
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
Affected Software
Event History
Frequently Asked Questions
What access or action does an attacker need to exploit this issue?
An attacker needs to convince a user to load a maliciously crafted checkpoint file. The CVSS vector indicates local access and low privileges, with no additional user interaction beyond the victim loading the file.
Who is most exposed to this vulnerability?
Users or environments that load checkpoint files from untrusted or insufficiently verified sources are exposed. A successful exploit can result in code execution with the privileges of the process loading the checkpoint and may enable privilege escalation, information disclosure, or data tampering.
What can be done while a patch is not available or cannot be applied?
Do not load checkpoint files from untrusted sources. Restrict who can supply checkpoint artifacts and verify their provenance before loading them.