NVIDIA Megatron‑LM contains a flaw that allows an attacker to cause remote code execution by persuading a user to load a maliciously crafted checkpoint file. The vulnerability can lead to code execution, privilege escalation, information disclosure and data tampering. The weakness stems from inadequate validation of checkpoint data during the loading process, identified as CWE‑502.

The vulnerability affects NVIDIA Megatron‑LM. No specific version range is listed in the public data, so all deployed installations of Megatron‑LM should be reviewed for the presence of the exploited flaw until the vendor issues a fix.

The CVSS score of 7.8 indicates a high severity, but the exploit probability is low (EPSS < 1 %) and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Because the attack requires an attacker to convince a user to load a malicious checkpoint, the likely vector is social engineering or user‑initiated file loading. In environments where checkpoint files are routinely loaded from untrusted sources, the risk rises, but in tightly controlled settings the chance of exploitation remains modest.