NVIDIA Megatron-LM contains a flaw in its checkpoint loading routine that allows an attacker to trigger remote code execution by presenting a specially crafted checkpoint file to a user. The vulnerability is classified as CWE-502 and, if exploited, can let an attacker run arbitrary code, elevate privileges, disclose confidential data, or tamper with data. The description specifically notes that a successful exploitation could lead to code execution, escalation of privileges, information disclosure, and data tampering.

The affected product is NVIDIA Megatron‑LM. No specific version range is provided in the description or CNA data, so any installation that relies on the checkpoint loading functionality may be vulnerable until a patch is applied.

The CVSS score of 7.8 indicates a high severity. The EPSS score is not available, so the current likelihood of exploitation is uncertain; however, elements of the CVE statement suggest that the exploit requires a user to load a malicious checkpoint file. Because the vulnerability can lead to full code execution, the risk remains significant. The vulnerability is not listed in the CISA KEV catalog, but its potential for widespread impact warrants close monitoring.