EUVD-2026-31056
GHSA-xcw5-rrcj-8hx5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
NVIDIA TRT-LLM for any platform contains a deserialization vulnerability and unsafe serialized handle. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
AnalysisAI
Deserialization of untrusted data in NVIDIA TensorRT-LLM across all platforms allows a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure by exploiting an unsafe serialized handle. The CVSS Changed Scope (S:C) indicates the impact can extend beyond the vulnerable component itself - notable given TensorRT-LLM's role as an inference serving library often integrated into multi-tenant or production AI infrastructure. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
NVIDIA TensorRT-LLM (cpe:2.3:a:nvidia:tensorrt-llm:*:*:*:*:*:*:*:*) is an open-source library that optimizes and serves large language model inference using NVIDIA GPUs. The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data): the library accepts serialized data - likely model weights, engine plans, or runtime handles - without sufficient integrity validation. The additional detail about an 'unsafe serialized handle' suggests a file descriptor or OS-level handle is embedded in the serialized stream, which when deserialized can be redirected or hijacked to access resources outside the intended scope. This class of vulnerability is well-documented in ML frameworks, where model loading pipelines often bypass security scrutiny applied to general application inputs.
RemediationAI
Consult the NVIDIA Product Security advisory at https://nvidia.custhelp.com/app/answers/detail/a_id/5805 for the official patched release version; an exact fix version is not independently confirmed in the available data beyond the advisory reference. As a compensating control pending patching, restrict local system access to the TensorRT-LLM process to only trusted, known users - reducing the PR:L attack surface. Where TensorRT-LLM loads model engines or serialized artifacts from disk, enforce path restrictions and file integrity checks (e.g., cryptographic signatures on engine files) to prevent substitution of malicious serialized payloads. Avoid loading serialized model data from untrusted or shared network locations.
More in Tensorrt Llm
View allUnsafe deserialization in NVIDIA TensorRT-LLM's RPC testing component allows a local high-privileged attacker to trigger
Unsafe deserialization in NVIDIA TensorRT-LLM's MPI server component allows a high-privileged local attacker to achieve
Insecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the
Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a ho
Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attack
Null pointer dereference in NVIDIA TensorRT-LLM across all supported platforms allows a local attacker to crash the appl
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (C
Missing authentication in NVIDIA TensorRT-LLM for Linux lets an attacker reach the disaggregated orchestrator's FastAPI
Server-side request forgery in NVIDIA TensorRT-LLM for Linux exposes AI inference servers to internal network pivoting v
Unsafe deserialization in NVIDIA TensorRT-LLM's visual gen server through version 1.3.0 rc11 allows a locally privileged
Missing authentication for a critical function in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allow
Improper control of code generation in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allows a locally
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today