CVE-2025-14920

CVE-2025-14920 is a Remote Code Execution (RCE) vulnerability affecting Hugging Face Transformers' Perceiver Model, stemming from insecure deserialization of untrusted data during model file parsing. With a CVSS score of 7.8 (High), this vulnerability requires user interaction (e.g., visiting a malicious page or opening a malicious file) for an attacker to execute arbitrary code with the privileges of the current user. Currently, there is no public exploit code available (Metasploit, Nuclei, ExploitDB), it is not listed in CISA's KEV catalog, and there is no community discussion or media coverage indicating active exploitation.