CVE-2025-14925: Hugging Face Accelerate RCE Vulnerability

CVE-2025-14925 Overview

CVE-2025-14925 is a deserialization of untrusted data vulnerability in Hugging Face Accelerate, a widely used PyTorch training and inference library. The flaw exists in the checkpoint parsing logic, which fails to properly validate user-supplied data before deserialization. An attacker can execute arbitrary code in the context of the current process by delivering a malicious checkpoint file.

Exploitation requires user interaction. The target must open a malicious file or visit a malicious page that triggers checkpoint loading. The issue was reported through Trend Micro's Zero Day Initiative as ZDI-CAN-27985 and published as advisory ZDI-25-1140.

Critical Impact
Successful exploitation grants an attacker code execution with the privileges of the process loading the checkpoint, enabling data theft, model poisoning, and lateral movement within ML pipelines.

Affected Products

Hugging Face Accelerate (checkpoint parsing component)
PyTorch-based training and inference workflows using Accelerate for checkpoint loading
ML pipelines and notebooks that deserialize third-party or shared checkpoints via Accelerate

Discovery Timeline

2025-12-23 - CVE-2025-14925 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14925

Vulnerability Analysis

The vulnerability is classified as Insecure Deserialization [CWE-502]. Hugging Face Accelerate parses checkpoint files to restore model weights, optimizer state, and training metadata. During this process, the library deserializes objects from the checkpoint without adequately validating their contents or restricting the classes that may be instantiated.

Python's default serialization stack for PyTorch checkpoints relies on pickle, which can execute arbitrary callables via the __reduce__ protocol during load. When Accelerate loads an attacker-controlled checkpoint, the embedded gadget chain runs immediately, before any model logic executes. This grants the attacker code execution in the current interpreter with the privileges of the user running the training or inference job.

The attack vector is local and requires user interaction, but ML workflows routinely download checkpoints from public hubs, shared storage, and collaborator artifacts. This exposure surface makes the vulnerability practical against data scientists, MLOps engineers, and CI/CD runners that automatically ingest models.

Root Cause

The root cause is the absence of proper validation on user-supplied checkpoint data prior to deserialization. Accelerate trusts the file structure and permits Python object reconstruction paths that instantiate arbitrary classes. Any callable reachable from the interpreter's import graph can be invoked as part of the deserialization sequence.

Attack Vector

An attacker crafts a malicious checkpoint file containing a pickle payload with a __reduce__ method that returns a callable such as os.system or subprocess.Popen and its arguments. The attacker distributes the file through a model hub, shared repository, phishing email, or compromised storage bucket. When a victim loads the checkpoint through Accelerate's loading APIs, the payload executes and the attacker gains code execution in the victim's process.

For technical specifics, see the Zero Day Initiative Advisory ZDI-25-1140. No public proof-of-concept code is available at this time.

Detection Methods for CVE-2025-14925

Indicators of Compromise

Unexpected child processes such as sh, bash, powershell.exe, or python spawned from Python interpreters running Accelerate or Jupyter kernels
Outbound network connections initiated shortly after checkpoint load operations to unfamiliar hosts
Checkpoint files (.pt, .bin, .ckpt, .safetensors wrappers) sourced from untrusted repositories or arriving through email or shared storage
New scheduled tasks, cron entries, or persistence artifacts created by ML workload processes

Detection Strategies

Instrument checkpoint loading paths to log the origin, hash, and signer of every file passed to Accelerate load functions
Alert on pickle.loads, torch.load, or Accelerator.load_state invocations that trigger process creation or network activity
Apply YARA or entropy-based scanning to checkpoint files searching for __reduce__, os.system, subprocess, or builtins.eval references inside pickle streams

Monitoring Recommendations

Forward endpoint process telemetry from ML workstations, training clusters, and CI runners to a centralized analytics platform
Baseline expected child processes for python, jupyter, and container images running Accelerate, then alert on deviations
Track downloads from public model hubs and correlate them with subsequent process and network events on the loading host

How to Mitigate CVE-2025-14925

Immediate Actions Required

Upgrade Hugging Face Accelerate to the latest fixed release as identified in the vendor advisory and rebuild container images that pin older versions
Treat every checkpoint from an external source as untrusted until its origin and integrity are verified
Prefer the safetensors format over pickle-based checkpoints wherever the workflow supports it, since safetensors does not execute code during load
Run training and inference jobs under least-privilege service accounts inside isolated containers or VMs

Patch Information

Refer to the Zero Day Initiative Advisory ZDI-25-1140 for the vendor coordination status and fixed version details. Monitor the Hugging Face Accelerate release notes on the project's official channels for the corresponding patched release and apply it across all environments that load checkpoints.

Workarounds

Restrict checkpoint loading to files retrieved from an internal, signed artifact repository with verified SHA-256 hashes
Execute checkpoint loading inside a sandbox with no network egress and no access to credentials, then export only validated tensors to production
Disable automatic model downloads in shared notebooks and CI pipelines, requiring explicit review of any new checkpoint source
Use weights_only=True when calling torch.load on PyTorch versions that support it, to constrain the deserializer to plain tensors