Code Execution Vulnerability in NVIDIA Megatron-LM Ensemble Classifier
CVE-2025-23354

7.8HIGH

Key Information:

Vendor

Nvidia
Status
Megatron-lm
Vendor
CVE Published:
24 September 2025

What is CVE-2025-23354?

NVIDIA Megatron-LM has a vulnerability in its ensemble_classifier script that allows attackers to submit malicious data, potentially leading to serious consequences such as arbitrary code execution, privilege escalation, unauthorized information disclosure, and data tampering. It is essential for users to apply appropriate mitigations to safeguard their systems against this exploitation risk.

Affected Version(s)

Megatron-LM All platforms All versions prior to 0.13.1 and 0.12.3

References

https://nvd.nist.gov/vuln/detail/CVE-2025-23354
https://www.cve.org/CVERecord?id=CVE-2025-23354
https://nvidia.custhelp.com/app/answers/detail/a_id/5698

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-23354 : Code Execution Vulnerability in NVIDIA Megatron-LM Ensemble Classifier