NVIDIA Megatron‑LM allows an attacker to supply a maliciously crafted checkpoint file that the application loads without proper validation. When such a checkpoint is imported, code can be executed, potentially leading to privilege escalation, data tampering, or information disclosure. The flaw is identified as CWE‑502, indicating improper handling of encoded input data.

The vulnerability affects NVIDIA Megatron‑LM. No specific version range is provided, meaning any deployment that uses the checkpoint loading feature is potentially impacted until an updated release is applied. Administrators should verify the SKU and version against vendor advisories to confirm exposure.

With a CVSS score of 7.8 the flaw is classified as high severity, yet the EPSS score of <1% suggests a low likelihood of exploitation in the near term. The vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires the attacker to persuade an authorized user to load the malicious checkpoint or to place the file in a location that the system auto‑loads, implying a local or socially engineered attack vector.