What is the CVSS score of CVE-2026-24188?

CVE-2026-24188 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of NVIDIA TensorRT are affected by CVE-2026-24188?

Organizations deploying NVIDIA TensorRT for AI/ML inference risk having their model outputs corrupted, potentially poisoning downstream business decisions and analytics.

How to fix or mitigate CVE-2026-24188?

Within 24 hours, conduct a comprehensive inventory of all systems running NVIDIA TensorRT and document their versions, prioritizing production AI inference environments. Within 7 days, implement network segmentation of GPU inference clusters to limit attacker access, deploy inference output validation mechanisms to detect anomalous results, and establish comprehensive logging and monitoring to identify any indicators of exploitation. Within 30 days, prepare for expedited deployment of NVIDIA's patched TensorRT 10.16.1 release when available from the vendor, conduct thorough testing of inference outputs post-upgrade to verify data integrity has been restored, and validate all AI/ML model outputs against a baseline to confirm no persistent corruption occurred.

NVIDIA TensorRT CVE-2026-24188

EUVD-2026-31141 HIGH

Out-of-bounds Write (CWE-787)

2026-05-20 nvidia

GHSA-pffw-vmg5-5gcr

Memory Corruption Nvidia Buffer Overflow Tensorrt

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

5.5 MEDIUM

TensorRT is a locally-invoked inference library requiring the victim to load a crafted model, so AV:L and UI:R; impact is data tampering only, giving I:H with C:N/A:N.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 23, 2026 - 12:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 12:23 vuln.today

cvss_changed

CVSS changed

Jul 23, 2026 - 12:23 NVD

8.2 (HIGH) 7.5 (HIGH)

Analysis Generated

May 20, 2026 - 20:00 vuln.today

DescriptionNVD

NVIDIA TensorRT contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to data tampering.

AnalysisAI

Out-of-bounds write in NVIDIA TensorRT prior to version 10.16.1 allows an attacker to corrupt memory and tamper with data during inference processing. The flaw affects the TensorRT SDK/runtime used for high-performance deep-learning inference on NVIDIA GPUs, and per the vendor CVSS the impact is limited to integrity (data tampering) with no confidentiality or availability loss. There is no public exploit identified at time of analysis and EPSS probability is negligible (0.04%), but CISA SSVC flags the issue as automatable.

Technical ContextAI

TensorRT is NVIDIA's SDK and runtime for optimizing and executing deep-learning inference on GPUs; it parses model artifacts (engines/serialized networks, ONNX graphs, plans) and executes optimized kernels. The root cause is CWE-787 (Out-of-bounds Write), a memory-corruption class where the software writes past the bounds of an allocated buffer - the community tags (Memory Corruption, Buffer Overflow) reinforce this. The single affected CPE is cpe:2.3:a:nvidia:tensorrt:*:*:*:*:*:*:*:* covering the TensorRT application/library. An OOB write in a model/input parsing or kernel path can overwrite adjacent memory, which the vendor characterizes as leading to data tampering rather than full code execution.

RemediationAI

Upgrade NVIDIA TensorRT to version 10.16.1 or later, which is the first fixed release per the EUVD advisory (Vendor-released patch: 10.16.1); consult the NVIDIA security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5836 for the exact package and platform builds. Until you can patch, only load and execute TensorRT engines, plans, and model files from trusted, integrity-verified sources - treat serialized engines and ONNX inputs as untrusted code, since deserializing an attacker-supplied artifact is the most plausible trigger; the trade-off is that this restricts pipelines that ingest third-party or user-supplied models. Where feasible, run inference workloads in an isolated or sandboxed process so a memory-corruption event cannot tamper with adjacent application data, accepting the added deployment complexity.