CVE-2026-65180
published 2026-10-13CVE-2026-65180: NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A…
PriorityP342high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.23%
13.1th percentile
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nvidia | megatron-lm | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
NVIDIA Megatron-LM code injection (EUVD-2026-98564)
vuldb·2026-10-13·CVSS 7.8
CVE-2026-65180 [HIGH] NVIDIA Megatron-LM code injection (EUVD-2026-98564)
A vulnerability identified as very critical has been detected in NVIDIA Megatron-LM. This affects an unknown part. Performing a manipulation results in code injection.
This vulnerability was named CVE-2026-65180. The attack may be initiated remotely. There is no available exploit.
GHSA
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file.
ghsa_unreviewed·2026-10-13
CVE-2026-65180 [HIGH] CWE-502 NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file.
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-13
Published