NVIDIA Megatron-LM Vulnerable to RCE via Untrusted Data Deserialization
A critical deserialization vulnerability in NVIDIA Megatron-LM allows remote attackers to execute arbitrary code by tricking users into opening malicious checkpoint files.
Zero Day Initiative (ZDI) has disclosed a critical remote code execution (RCE) vulnerability affecting NVIDIA's Megatron-LM, a powerful framework for training large-scale deep learning models. The vulnerability, tracked as ZDI-26-904 and assigned CVE-2026-65110, carries a significant CVSS score of 7.8, indicating a high level of risk.
The core of the issue lies in the way Megatron-LM handles checkpoint files. Specifically, the framework fails to adequately validate user-supplied data during the deserialization process. This oversight allows a malicious actor to craft a checkpoint file that, when processed by an affected installation of Megatron-LM, leads to the deserialization of untrusted data. Successful exploitation enables an attacker to execute arbitrary code within the context of the current process.
Exploitation of this vulnerability requires user interaction. An attacker must trick a user into opening a specially crafted, malicious checkpoint file. This could be achieved through various social engineering tactics, such as convincing a user to download and load a seemingly legitimate but compromised model checkpoint.
NVIDIA has addressed this vulnerability by releasing version 0.17.1 of Megatron-LM. Users are strongly advised to update to this patched version to mitigate the risk. Further details on the fix can be found in the product security repository here.
The disclosure timeline indicates that the vulnerability was initially reported to the vendor on June 2, 2026. Following a coordinated disclosure process, the advisory was publicly released on November 10, 2026, with an update to the advisory also occurring on the same date. The research and responsible disclosure were credited to security researcher winters0x64.
This vulnerability highlights a recurring theme in cybersecurity: the dangers of deserializing untrusted data. Many complex software systems, particularly those dealing with model serialization in machine learning, can fall prey to these flaws if proper validation and sanitization are not rigorously implemented. The impact can be severe, ranging from denial-of-service to full system compromise.
Given the critical nature of Megatron-LM in training large AI models, a successful exploit could have significant implications for organizations relying on this framework. Compromised systems could be used for malicious purposes, such as cryptocurrency mining, deploying ransomware, or further expanding attack surfaces within a network.
As with many such vulnerabilities, prompt patching and vigilance against social engineering attempts are the primary defenses. Organizations using NVIDIA Megatron-LM should prioritize updating to the latest secure version and educate their users about the risks associated with handling untrusted files.