EUVD-2025-209903
GHSA-gvr5-23jj-pf9p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
NVIDIA TRT-LLM for any platform contains a vulnerability in MPI server, where an attacker could cause an unsafe deserialization. A successful exploit of this vulnerability might lead to code execution, denial of service, data tampering, and information disclosure.
AnalysisAI
Unsafe deserialization in NVIDIA TensorRT-LLM's MPI server component allows a high-privileged local attacker to achieve code execution, denial of service, data tampering, or information disclosure on systems running the affected library. The CVSS 7.5 score reflects high impact but constrained exploitability (AV:L/AC:H/PR:H), and no public exploit identified at time of analysis. Scope change (S:C) indicates compromise can extend beyond the vulnerable component to impact other resources on the host.
Technical ContextAI
TensorRT-LLM (TRT-LLM) is NVIDIA's open-source library for optimizing large language model inference on NVIDIA GPUs, commonly deployed in multi-GPU and multi-node configurations using MPI (Message Passing Interface) for distributed workload coordination. The vulnerability resides in the MPI server component, which evidently accepts serialized objects from peer processes and reconstructs them without sufficient validation. The root cause is CWE-502 (Deserialization of Untrusted Data) - a class of flaw where attacker-influenced serialized payloads are reconstructed into in-memory objects, allowing gadget chains or type confusion to drive arbitrary code paths during the deserialization process itself, before any application-level authorization checks run.
RemediationAI
Patch available per vendor advisory - consult NVIDIA's official security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5805 for the exact fixed TensorRT-LLM version and upgrade to that release. Until upgrading is feasible, compensating controls include restricting MPI traffic to a dedicated isolated network segment with strict firewall rules (block external access to MPI ports, typically in the 1024-65535 ephemeral range used by Open MPI/MPICH), enforcing host-level authentication and authorization for any user able to join the MPI communicator, and avoiding multi-tenant TRT-LLM deployments where untrusted workloads share the same MPI fabric - the trade-off being reduced flexibility for shared GPU cluster usage. Additionally, monitor MPI server processes for unexpected child processes or outbound connections as a detective control, accepting the limitation that exploitation may occur in-memory without spawning new processes.
More in Tensorrt Llm
View allDeserialization of untrusted data in NVIDIA TensorRT-LLM across all platforms allows a local, low-privileged attacker to
Unsafe deserialization in NVIDIA TensorRT-LLM's RPC testing component allows a local high-privileged attacker to trigger
Insecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the
Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a ho
Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attack
Null pointer dereference in NVIDIA TensorRT-LLM across all supported platforms allows a local attacker to crash the appl
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (C
Missing authentication in NVIDIA TensorRT-LLM for Linux lets an attacker reach the disaggregated orchestrator's FastAPI
Server-side request forgery in NVIDIA TensorRT-LLM for Linux exposes AI inference servers to internal network pivoting v
Unsafe deserialization in NVIDIA TensorRT-LLM's visual gen server through version 1.3.0 rc11 allows a locally privileged
Missing authentication for a critical function in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allow
Improper control of code generation in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allows a locally
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today