CVE-2025-13707
Deserialization RCE in Tencent HunyuanDiT model_resume Function
Publication date: 2025-12-23
Last updated on: 2025-12-23
Assigner: Zero Day Initiative
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tencent | hunyuan | 3.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a remote code execution flaw in the Tencent HunyuanDiT model_resume function. It occurs because the function improperly validates user-supplied data, leading to deserialization of untrusted data. An attacker can exploit this by tricking a user into visiting a malicious page or opening a malicious file, allowing the attacker to execute arbitrary code with root privileges on the affected system.
How can this vulnerability impact me? :
If exploited, this vulnerability allows an attacker to execute arbitrary code with root privileges on the affected system. This can lead to full system compromise, unauthorized access to sensitive data, disruption of services, and potential further attacks within the network.