NVIDIA Megatron‑LM includes a vulnerability in its hybrid conversion script that allows an attacker to execute arbitrary code by tricking a user into loading a specially crafted file. The flaw can enable not only code execution but also privilege escalation, data disclosure, and tampering, compromising both confidentiality and integrity of the system.

This issue affects NVIDIA Megatron‑LM products. All versions of the Megatron‑LM hybrid conversion script that have not applied the vendor’s security update are vulnerable; specific affected releases are not enumerated in the available data.

The CVSS score of 7.8 indicates a high severity vulnerability, while the EPSS score of less than 1% suggests low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to persuade a user to run the malicious file, after which the script would deserialize the payload and execute it, exploiting a deserialization flaw (CWE‑502).