High
Security advisory
NVIDIA Megatron-LM for all platforms contains a vulnerability in the pretrain_gpt script, where malicious data created by an attacker may cause a code injection issue. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-23348
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 11:31 UTC · Revision 1
Source evidence
NVIDIA Megatron-LM for all platforms contains a vulnerability in the pretrain_gpt script, where malicious data created by an attacker may cause a code injection issue. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.
osv:CVE-2025-23348
Complete source record
{
"id": "58326450f43f76c9aa27852fc2e9f5063e5f38ba06fc14f67d75f1fba33fb57b",
"url": "https://osv.dev/vulnerability/CVE-2025-23348",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2025-23348",
"summary": "NVIDIA Megatron-LM for all platforms contains a vulnerability in the pretrain_gpt script, where malicious data created by an attacker may cause a code injection issue. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.",
"evidence": "osv:CVE-2025-23348",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2025-23348",
"aliases": [
"CVE-2025-23348"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/nvidia/megatron-lm",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "3ea68ad6042cc1204386ae9364358f7c4de1bc37"
},
{
"introduced": "c550cf6c41c31cd3ec72e05c25ea0c979f2b6631"
},
{
"last_affected": "ac198fc0d60a8c748597e01ca4c6887d3a7bcf3d"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:nvidia:megatron-lm:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "0.12.3"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:nvidia:megatron-lm:0.13.0:-:*:*:*:*:*:*",
"range": [
{
"introduced": "0.13.0-NA"
},
{
"last_affected": "0.13.0-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:nvidia:megatron-lm:0.13.0:rc0:*:*:*:*:*:*",
"range": [
{
"introduced": "0.13.0-rc0"
},
{
"last_affected": "0.13.0-rc0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:nvidia:megatron-lm:0.13.0:rc1:*:*:*:*:*:*",
"range": [
{
"introduced": "0.13.0-rc1"
},
{
"last_affected": "0.13.0-rc1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:nvidia:megatron-lm:0.13.0:rc2:*:*:*:*:*:*",
"range": [
{
"introduced": "0.13.0-rc2"
},
{
"last_affected": "0.13.0-rc2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:nvidia:megatron-lm:0.13.0:rc3:*:*:*:*:*:*",
"range": [
{
"introduced": "0.13.0-rc3"
},
{
"last_affected": "0.13.0-rc3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:nvidia:megatron-lm:0.13.0:rc4:*:*:*:*:*:*",
"range": [
{
"introduced": "0.13.0-rc4"
},
{
"last_affected": "0.13.0-rc4"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"0.13.0-NA",
"0.13.0-rc0",
"0.13.0-rc1",
"0.13.0-rc2",
"0.13.0-rc3",
"0.13.0-rc4",
"core_v0.13.0rc4",
"core_v0.13.0rc3",
"core_v0.12.2",
"core_v0.13.0rc2",
"core_v0.13.0rc1",
"core_v0.13.0rc0",
"core_v0.12.1",
"core_v0.12.0",
"v0.12.0rc3",
"core_v0.12.0rc3",
"25.04-alpha.rc1",
"v0.12.0rc2",
"core_v0.12.0rc2",
"NVLM-1.0",
"23.06",
"23.04",
"megatron-main-before-moe",
"v2.6",
"v2.5",
"v2.0",
"v1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-23348.json"
}
}
],
"modified": "2026-10-28T02:30:34.623329019Z",
"provider": "osv",
"references": [
"https://nvidia.custhelp.com/app/answers/detail/a_id/5698",
"https://www.cve.org/CVERecord?id=CVE-2025-23348",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23348.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-23348"
],
"provider_metadata": {
"cwe_ids": [
"CWE-94"
],
"cna_assigner": "nvidia",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"fixed": "0.13.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "VersionTextExtraction"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23348.json"
}
},
"related_cves": [
{
"value": "CVE-2025-23348",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 502051,
"published_at": "2025-09-24T13:13:43.423+00:00"
}