NVIDIA Megatron-LM: malicious checkpoint files execute code when loaded

Impact

Megatron-LM loads a checkpoint and the checkpoint runs code. NVIDIA split this across two ids in bulletin 2026/5881 (CVE-2026-65110 and CVE-2026-65180) with the same score, the same component and the same description, so treat them as one action. The attacker gets execution as the training job, which on a GPU fleet is typically a long-lived pod holding cluster credentials, shared dataset mounts and write access to the checkpoint store - enough to poison later runs. Any workflow that resumes from a checkpoint pulled off a shared filesystem, an object store or a model hub is the exposure; the trust boundary nobody draws is between whoever can write a checkpoint and whoever runs it.

Who can reach it

Local, authenticated low-privileged user, no interaction beyond loading the file (CVSS AV:L/AC:L/PR:L/UI:N) - anyone who can write to the checkpoint path a training job reads, or who can convince an operator to resume from their file.

What to do

Upgrade Megatron-LM to the fixed version in NVIDIA bulletin 2026/5881 and restart training jobs with the new package or image. Alongside the patch, restrict write access to checkpoint stores and do not load checkpoints from sources you do not control - the structural issue outlives any one fix. The NVD record carries no fixed version; take it from the bulletin.

Also covers 1 CVE

The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.

References

Related entries

• NVIDIA NeMo Speech: code injection from malicious input, no user interaction neededCVE-2026-65111 · NVIDIA NeMo SpeechHigh
• NVIDIA Isaac Lab: eval injection allows code execution from attacker-influenced inputCVE-2026-65141 · NVIDIA Isaac LabHigh
• NVIDIA Model-Optimizer: deserialization of untrusted data leads to code executionCVE-2026-65142 · NVIDIA Model-Optimizer (model/checkpoint deserialization)High
• NVIDIA NeMo: a crafted model_config.yaml injects unsafe parameters into dataset loadingCVE-2026-65178 · NVIDIA NeMo (dataset-loading workflow, model_config.yaml parameter injection)High
• PyTorch (flatbuffer model parsing, torch::load / parse_and_initialize_mobile_module): MALICIOUS MODEL FILE TO MEMORYNCVD-2025-019-pytorch-flatbuffer-model-parsing · PyTorch (flatbuffer model parsing, torch::load / parse_and_initialize_mobile_module)High
• LangChain (Web Research Retriever): SSRFCVE-2024-3095 · LangChain (Web Research Retriever)High