NVIDIA Patches High-Severity Code Injection Flaws in Megatron-LM AI Framework

Nvidia has issued an important security update addressing multiple high-severity vulnerabilities in its Megatron-LM AI framework, a large language model project widely used in AI research and enterprise environments. The update covers four CVEs, each with a CVSS base score of 7.8 (High) and capable of enabling code execution, privilege escalation, information disclosure, or data tampering.

The vulnerabilities are CVE-2025-23348, found in the pretrain_gpt script; CVE-2025-23349, in tasks/orqa/unsupervised/nq.py; CVE-2025-23353, in the msdp preprocessing script; and CVE-2025-23354, in the ensemble_classifier script. Each could allow attackers to compromise AI workflows running on Megatron-LM. The issues affect all versions prior to 0.13.1 and 0.12.3 across Windows, Linux and macOS, and Nvidia urges users to apply the update immediately.

According to Nvidia, the flaws pose risks such as code injection, tampering with inputs and potential unauthorised code execution in sensitive HPC environments handling large amounts of training data.