EUVD-2026-31056
GHSA-xcw5-rrcj-8hx5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access
-
DeliveryCraft malicious serialized TensorRT-LLM payload
-
ExploitReplace or inject serialized engine/handle artifact
-
ExecutionTrigger TensorRT-LLM deserialization routine
-
PersistExploit unsafe handle processing
-
ImpactExecute arbitrary code beyond component scope
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Local system access is required; this vulnerability cannot be triggered remotely (AV:L). The attacker must hold a low-privileged account on the target system (PR:L) and must be able to influence the serialized input processed by TensorRT-LLM - for example, by providing or replacing a model engine file, a serialized runtime object, or a handle passed to the library. No user interaction is required once the malicious artifact is in place (UI:N). Exploitation is limited to environments where untrusted or semi-trusted local users can interact with TensorRT-LLM's input pipeline; isolated single-user workstations or containerized deployments with strict filesystem access controls significantly reduce exposure. |
| Impact | The CVSS 6.3 score reflects a local exploitation path (AV:L) requiring low privileges (PR:L) with low attack complexity (AC:L), no user interaction (UI:N), and a Changed Scope (S:C) with low-level impacts across confidentiality, integrity, and availability. The Changed Scope is the most significant signal - it implies a successful exploit can affect components or processes beyond TensorRT-LLM itself, consistent with the code execution and data tampering impacts described. EPSS data is not provided, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, and no POC has been identified. Real-world risk is elevated in shared or multi-tenant inference environments where multiple users or services have local system access, but is constrained for isolated single-user deployments. The wildcard CPE (all versions) suggests broad exposure across the TensorRT-LLM install base; exact patched versions must be confirmed from the NVIDIA advisory. |
| Exploit ScenarioDerived | A low-privileged local user on a system running TensorRT-LLM crafts a malicious serialized payload - such as a manipulated engine file or runtime handle object - and causes the library to deserialize it, triggering unsafe handle processing. Because scope is Changed, the resulting code execution or resource access may extend to adjacent processes or privileged components beyond the TensorRT-LLM runtime itself. No public POC exists at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 20, 2026
Deserialization of untrusted data in NVIDIA TensorRT-LLM across all platforms allows a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure by exploiting an unsafe serialized handle. The CVSS Changed Scope (S:C) indicates the impact can extend beyond the vulnerable component itself - notable given TensorRT-LLM's role as an inference serving library often integrated into multi-tenant or production AI infrastructure. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
RemediationAI
Consult the NVIDIA Product Security advisory at https://nvidia.custhelp.com/app/answers/detail/a_id/5805 for the official patched release version; an exact fix version is not independently confirmed in the available data beyond the advisory reference. As a compensating control pending patching, restrict local system access to the TensorRT-LLM process to only trusted, known users - reducing the PR:L attack surface. Where TensorRT-LLM loads model engines or serialized artifacts from disk, enforce path restrictions and file integrity checks (e.g., cryptographic signatures on engine files) to prevent substitution of malicious serialized payloads. Avoid loading serialized model data from untrusted or shared network locations.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NVIDIA TensorRT-LLM (cpe:2.3:a:nvidia:tensorrt-llm:*:*:*:*:*:*:*:*) is an open-source library that optimizes and serves large language model inference using NVIDIA GPUs. The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data): the library accepts serialized data - likely model weights, engine plans, or runtime handles - without sufficient integrity validation. The additional detail about an 'unsafe serialized handle' suggests a file descriptor or OS-level handle is embedded in the serialized stream, which when deserialized can be redirected or hijacked to access resources outside the intended scope. This class of vulnerability is well-documented in ML frameworks, where model loading pipelines often bypass security scrutiny applied to general application inputs.
Know when Tensorrt Llm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
NVIDIA TRT-LLM for any platform contains a deserialization vulnerability and unsafe serialized handle. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in NVIDIA TRT-LLM Deserialization and Memory Flaws
View all 4More in Tensorrt Llm
View allInsecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the
TensorRT-LLM 1.3.0rc24 can load a tokenizer from an attacker-influenced location during KvCacheAwareRouter initializatio
Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a ho
Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attack
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (C
Missing authentication in NVIDIA TensorRT-LLM for Linux lets an attacker reach the disaggregated orchestrator's FastAPI
Server-side request forgery (SSRF) in NVIDIA TensorRT-LLM 1.3.0rc24 allows an attacker who can reach a local input vecto
Server-side request forgery (CWE-918) in NVIDIA TensorRT-LLM, reported by NVIDIA at CVSS 7.1, allows an attacker positio
Server-side request forgery in NVIDIA TensorRT-LLM for Linux exposes AI inference servers to internal network pivoting v
Exploit-DB