EUVD-2026-31057
GHSA-qvvq-q6v7-7fhg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
NVIDIA TRT-LLM for any platform contains a vulnerability in RPC testing, where an attacker could cause an unsafe deserialization. A successful exploit of this vulnerability might lead to code execution, denial of service, data tampering, and information disclosure.
AnalysisAI
Unsafe deserialization in NVIDIA TensorRT-LLM's RPC testing component allows a local high-privileged attacker to trigger code execution, denial of service, data tampering, or information disclosure across a changed scope. The flaw is rated CVSS 7.5 despite local-only access and high attack complexity because successful exploitation crosses a security boundary (S:C) and yields full CIA impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
TensorRT-LLM (TRT-LLM) is NVIDIA's open-source library for optimizing and serving large language model inference on NVIDIA GPUs, commonly deployed in AI inference clusters and used with Triton Inference Server. The vulnerability resides in an RPC-based testing pathway and is classified as CWE-502 (Deserialization of Untrusted Data), meaning the component reconstructs language-native objects (likely Python pickle, given the TRT-LLM Python stack) from attacker-influenced byte streams without validating the type or contents. When deserialization is performed on untrusted input, gadget chains in the loaded modules can be invoked during object reconstruction, turning a data parse into arbitrary execution. The single affected CPE entry (cpe:2.3:a:nvidia:tensorrt-llm:*:*:*:*:*:*:*:*) covers all versions of the product up to the vendor-released fix.
RemediationAI
Patch available per vendor advisory - upgrade NVIDIA TensorRT-LLM to the fixed release identified in NVIDIA bulletin 5805 (https://nvidia.custhelp.com/app/answers/detail/a_id/5805); exact fixed version is not enumerated in the supplied data and should be taken from that advisory. Until the upgrade is deployed, do not expose the TRT-LLM RPC testing interface beyond trusted operators, remove or disable test/RPC entry points in production inference deployments, and restrict file-system and process access on inference hosts so that only the dedicated service account can reach the RPC socket (trade-off: this may break developer test workflows that rely on the same RPC path). For multi-tenant inference clusters, segment tenants onto separate hosts or namespaces to prevent a compromised tenant from reaching another tenant's TRT-LLM process via the changed-scope component.
More in Tensorrt Llm
View allDeserialization of untrusted data in NVIDIA TensorRT-LLM across all platforms allows a local, low-privileged attacker to
Unsafe deserialization in NVIDIA TensorRT-LLM's MPI server component allows a high-privileged local attacker to achieve
Insecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the
Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a ho
Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attack
Null pointer dereference in NVIDIA TensorRT-LLM across all supported platforms allows a local attacker to crash the appl
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (C
Missing authentication in NVIDIA TensorRT-LLM for Linux lets an attacker reach the disaggregated orchestrator's FastAPI
Server-side request forgery in NVIDIA TensorRT-LLM for Linux exposes AI inference servers to internal network pivoting v
Unsafe deserialization in NVIDIA TensorRT-LLM's visual gen server through version 1.3.0 rc11 allows a locally privileged
Missing authentication for a critical function in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allow
Improper control of code generation in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allows a locally
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today