CVE-2025-14924: 
NixOS vulnerability analysis and mitigation

CVE-2025-14924 is a deserialization of untrusted data (CWE-502) vulnerability in Hugging Face Transformers, specifically within the megatron_gpt2 checkpoint parsing component, that allows remote attackers to execute arbitrary code. The flaw was discovered by Michael DePlante (@izobashi) of Trend Micro's Zero Day Initiative (ZDI) and reported on September 3, 2025; after the vendor declined to remediate, ZDI published a 0-day advisory on December 18, 2025, and the CVE was formally assigned on December 23, 2025. The confirmed affected version is Hugging Face Transformers 4.55.0; downstream products including IBM Storage Fusion and IBM watsonx Data Intelligence are also affected. The CVSS v3.0 base score is 7.8 (High), assigned by ZDI (ZDI Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) and resides in the checkpoint parsing logic of the megatron_gpt2 module within Hugging Face Transformers. When a user opens a malicious model checkpoint file or visits a page that triggers checkpoint loading, the library fails to properly validate user-supplied data before deserializing it, allowing an attacker to embed arbitrary executable objects within the checkpoint. Exploitation requires user interaction — specifically, a victim must open a crafted malicious file or visit a page that causes the vulnerable parsing code to execute — but requires no privileges on the target system. The attack vector is classified as local (AV:L) because the malicious file must be processed on the victim's machine, though the attacker can deliver it remotely (ZDI Advisory, Red Hat Bugzilla).

Successful exploitation allows an attacker to execute arbitrary code in the context of the process running Hugging Face Transformers, resulting in high confidentiality, integrity, and availability impact. An attacker could steal model weights, training data, API keys, or other sensitive artifacts accessible to the process, modify or corrupt model files, or cause a denial of service. In ML pipeline environments where Transformers runs with elevated privileges or has access to sensitive infrastructure, exploitation could facilitate lateral movement or broader system compromise (ZDI Advisory, IBM Advisory).

The ZDI published this as a 0-day advisory on December 18, 2025, after Hugging Face declined to patch the issue, meaning no official vendor fix existed at the time of disclosure. A ZDI advisory (ZDI-25-1141) serves as a public proof-of-concept reference, though no weaponized exploit kit or active in-the-wild exploitation has been confirmed. The EPSS score is approximately 0.0022 (0.22%), indicating a currently low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report (ZDI Advisory, Red Hat Bugzilla).

1. Craft a malicious checkpoint file: Create a Python pickle or other serializable checkpoint file for the megatron_gpt2 format that embeds a malicious payload (e.g., a reverse shell command) within a serialized object that executes upon deserialization.
2. Deliver the malicious file: Host the crafted checkpoint on a web page, file share, or model repository (e.g., a spoofed Hugging Face Hub repository), or send it directly to the target via email or messaging.
3. Induce user interaction: Trick the target user into opening the malicious checkpoint file or visiting a page that triggers automatic loading of the checkpoint via the Transformers library (e.g., a script calling from_pretrained() pointing to the malicious source).
4. Trigger deserialization: When the Transformers library parses the checkpoint via the megatron_gpt2 loading code, it deserializes the untrusted data without proper validation, executing the embedded payload.
5. Achieve code execution: The malicious payload runs in the context of the Python process, granting the attacker the same privileges as the victim's process — enabling data exfiltration, persistence, or further lateral movement (ZDI Advisory).

• File System: Unexpected or unfamiliar .pt, .bin, or pickle-format checkpoint files in model directories; newly created scripts or executables in directories writable by the Python/Transformers process.
• Process: Unusual child processes spawned by the Python interpreter (e.g., bash, sh, curl, wget, nc) during or after model loading operations; unexpected network connections initiated by the Python process.
• Network: Outbound connections from ML workstations or servers to unknown external IPs or domains shortly after loading a model checkpoint, particularly on non-standard ports.
• Logs: Python runtime errors or tracebacks related to megatron_gpt2 checkpoint parsing; unexpected imports or module loads logged during model initialization.

Hugging Face declined to patch this vulnerability, stating no changes would be made; however, a patch was made available through Red Hat's advisory (Bugzilla ID: 2424734) as of December 24, 2025, and IBM has issued advisories for affected products (IBM Storage Fusion, IBM Fusion HCI, Content-Aware Storage, and watsonx Data Intelligence). Users should update to patched versions as provided by Red Hat or IBM. As a workaround, ZDI recommends restricting interaction with the product — specifically, only loading model checkpoints from fully trusted, verified sources and avoiding automatic loading of externally supplied checkpoint files. Organizations should also implement strict allowlisting of model sources and consider sandboxing ML workloads to limit the blast radius of any exploitation (ZDI Advisory, Red Hat Bugzilla, IBM Advisory).

The disclosure generated notable attention due to Hugging Face's decision to close the report as "informative" and decline any remediation, prompting ZDI to publish the advisory as a 0-day — a relatively rare outcome that highlights vendor accountability concerns in the ML/AI ecosystem. ZDI researcher Michael DePlante (@izobashi) was credited with the discovery. Red Hat independently tracked the issue and opened a high-severity bug report, reflecting downstream concern from enterprise Linux distributors. IBM subsequently issued advisories for multiple affected products, indicating broader supply chain impact (ZDI Advisory, IBM Advisory).