NVIDIA TensorRT-LLM CVE-2026-24163

Exploitation requires local access to a host running NVIDIA TensorRT-LLM (AV:L) and high pre-existing privileges on that host (PR:H), and the attacker must reach the RPC testing interface specifically - not the general inference API - meaning a deployment that exposes or leaves enabled the TRT-LLM RPC test pathway. Attack complexity is High (AC:H), indicating additional conditions outside the attacker's control such as timing, configuration state, or specific RPC operations being available. No user interaction is required (UI:N). The local vector combined with high privileges sharply limits realistic exploitation to insiders, compromised service accounts, or co-tenants on shared GPU infrastructure; an internet-facing inference endpoint alone does not satisfy these prerequisites unless the RPC test surface is also exposed.

Signals point in different directions and should be weighed together. The CVSS base of 7.5 is driven by full C/I/A impact and scope change, but the vector (AV:L/AC:H/PR:H) materially constrains real-world exploitability: the attacker must already be on the host, must hold high privileges, and must navigate non-trivial conditions. No EPSS or KEV listing is present in the supplied data, and no public exploit code has been identified, so this is not a mass-exploitation candidate. The more plausible threat models are post-compromise privilege/scope escalation on an inference node, or a malicious insider in a multi-tenant ML pipeline abusing the RPC test surface to pivot. Note the apparent tension between the description (suggesting a 'TRT-LLM for any platform' RPC testing path) and the CVSS local vector - defenders should verify with the NVIDIA advisory whether the RPC endpoint is ever reachable across a network in any supported deployment, since that would materially change the risk picture.

An attacker who has already gained a high-privileged local foothold on an inference host - for example a compromised MLOps account or a malicious co-tenant on a shared GPU node - sends a crafted serialized payload to the TRT-LLM RPC testing interface. The deserializer reconstructs attacker-controlled objects, triggering code execution in the TRT-LLM process context and, because scope is changed, allowing impact on resources beyond the original security boundary such as other model artifacts, API keys, or adjacent services. No public exploit identified at time of analysis, but CWE-502 issues in Python-based ML stacks are historically straightforward to weaponize once the wire format is known.