CVE-2025-23353

NVIDIA Megatron-LM for all platforms contains a vulnerability in the msdp preprocessing script where malicious data created by an attacker may cause an injection. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, Information disclosure, and data tampering.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvidiaCNA
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 5%
VendorProductVersion
nvidiamegatron-lm
𝑥
< 0.12.3
nvidiamegatron-lm
0.13.0
nvidiamegatron-lm
0.13.0:rc0
nvidiamegatron-lm
0.13.0:rc1
nvidiamegatron-lm
0.13.0:rc2
nvidiamegatron-lm
0.13.0:rc3
nvidiamegatron-lm
0.13.0:rc4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://nvd.nist.gov/vuln/detail/CVE-2025-23353
https://nvidia.custhelp.com/app/answers/detail/a_id/5698
https://www.cve.org/CVERecord?id=CVE-2025-23353