PT-2025-26749 · Nvidia · Nvidia Megatron-Lm

Hao Fan + 1 · Published 2025-06-24 · Updated 2025-06-26 · CVE-2025-23264

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: NVIDIA Megatron-LM (affected versions not specified)

Description: The issue concerns a code injection vulnerability in a python component of NVIDIA Megatron-LM. An attacker can exploit this by providing a malicious file, potentially leading to code execution, escalation of privileges, information disclosure, and data tampering.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2025-10374

CVE-2025-23264

Affected Products

Nvidia Megatron-Lm

References · 10

• https://osv.dev/vulnerability/CVE-2025-23264 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10374 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-23264 · Security Note
• https://nvidia.custhelp.com/app/answers/detail/a_id/5663 · Vendor Advisory
• https://twitter.com/transilienceai/status/1938030872780796370 · Twitter Post
• https://twitter.com/CVEnew/status/1937539871607824814 · Twitter Post
• https://twitter.com/TweetThreatNews/status/1938001431060963402 · Twitter Post
• https://t.me/cvetracker/26953 · Telegram Post
• https://twitter.com/dailytechonx/status/1937941362676273455 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1937690918104256866 · Twitter Post