CVE-2025-13708
Deserialization RCE in Tencent NeuralNLP _load_checkpoint Function
Publication date: 2025-12-23
Last updated on: 2025-12-23
Assigner: Zero Day Initiative
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tencent | neuralnlp-neuralclassifier | 3.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability can allow remote attackers to execute arbitrary code with root privileges on affected systems. This can lead to full system compromise, unauthorized access, data theft, or disruption of services.
Can you explain this vulnerability to me?
This vulnerability exists in the _load_checkpoint function of Tencent NeuralNLP-NeuralClassifier. It involves deserialization of untrusted data due to improper validation of user-supplied input. An attacker can exploit this by tricking a user into visiting a malicious page or opening a malicious file, which allows remote code execution in the context of root.