EUVD-2026-31141
GHSA-pffw-vmg5-5gcr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious TensorRT model/engine
-
DeliveryDeliver artifact to inference pipeline
-
ExploitTensorRT parses crafted input
-
ExecutionTrigger out-of-bounds write
-
ImpactTamper with inference data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a vulnerable TensorRT build (any version below 10.16.1) parse or execute attacker-influenced content - a crafted model, serialized engine/plan, or inference input - to trigger the out-of-bounds write. The published CVSS vector (AV:N/AC:L/PR:N/UI:N) implies no authentication or user interaction and a network vector, but this conflicts with TensorRT's typical use as a locally-invoked inference library, so realistic exploitation is limited to environments that ingest and process untrusted model artifacts or inputs. Limiting factors: the attacker must get their malicious artifact into a processing path, and impact is confined to integrity/data tampering (C:N/A:N) rather than code execution or crash. |
| Impact | The signals are mostly consistent toward moderate, non-urgent risk. The vendor CVSS of 7.5 is driven entirely by a High integrity impact (I:H) with C:N/A:N, so the 'high' rating reflects data tampering only, not RCE or denial of service. EPSS is very low (0.04%, 11th percentile) and CISA SSVC records Exploitation: none and Technical Impact: partial, so this is not an active-exploitation priority. However, SSVC Automatable: yes indicates that, if a working technique emerges, it could be reliably scripted. A notable inconsistency: the CVSS vector claims AV:N/PR:N/UI:N (remote, unauthenticated, no interaction), yet TensorRT is predominantly a locally-invoked inference library - realistic exploitation almost certainly requires the victim to load a crafted model or input, implying a local/interaction-dependent vector; verify the true attack surface with NVIDIA before treating this as remotely exploitable. |
| Exploit ScenarioDerived | An attacker crafts a malicious TensorRT engine, plan, or model input and delivers it to a system or pipeline that automatically parses and runs it (for example, an inference service that accepts user-supplied models). When TensorRT processes the crafted artifact, the out-of-bounds write corrupts memory and tampers with inference data or adjacent state. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 23, 2026
Out-of-bounds write in NVIDIA TensorRT prior to version 10.16.1 allows an attacker to corrupt memory and tamper with data during inference processing. The flaw affects the TensorRT SDK/runtime used for high-performance deep-learning inference on NVIDIA GPUs, and per the vendor CVSS the impact is limited to integrity (data tampering) with no confidentiality or availability loss. There is no public exploit identified at time of analysis and EPSS probability is negligible (0.04%), but CISA SSVC flags the issue as automatable.
Earlier versions of this analysis (1)
Out-of-bounds write in NVIDIA TensorRT allows remote attackers to corrupt memory and tamper with data processed by the inference engine, per NVIDIA's own advisory (KB 5836). The CVSS 8.2 score reflects high integrity impact with no privileges or user interaction required, though confidentiality is unaffected. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
RemediationAI
Upgrade NVIDIA TensorRT to version 10.16.1 or later, which is the first fixed release per the EUVD advisory (Vendor-released patch: 10.16.1); consult the NVIDIA security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5836 for the exact package and platform builds. Until you can patch, only load and execute TensorRT engines, plans, and model files from trusted, integrity-verified sources - treat serialized engines and ONNX inputs as untrusted code, since deserializing an attacker-supplied artifact is the most plausible trigger; the trade-off is that this restricts pipelines that ingest third-party or user-supplied models. Where feasible, run inference workloads in an isolated or sandboxed process so a memory-corruption event cannot tamper with adjacent application data, accepting the added deployment complexity.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TensorRT is NVIDIA's SDK and runtime for optimizing and executing deep-learning inference on GPUs; it parses model artifacts (engines/serialized networks, ONNX graphs, plans) and executes optimized kernels. The root cause is CWE-787 (Out-of-bounds Write), a memory-corruption class where the software writes past the bounds of an allocated buffer - the community tags (Memory Corruption, Buffer Overflow) reinforce this. The single affected CPE is cpe:2.3:a:nvidia:tensorrt:*:*:*:*:*:*:*:* covering the TensorRT application/library. An OOB write in a model/input parsing or kernel path can overwrite adjacent memory, which the vendor characterizes as leading to data tampering rather than full code execution.
Know when Tensorrt gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
TensorRT is a locally-invoked inference library requiring the victim to load a crafted model, so AV:L and UI:R; impact is data tampering only, giving I:H with C:N/A:N.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
NVIDIA TensorRT contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to data tampering.
Executive ViewAI
Organizations deploying NVIDIA TensorRT for AI/ML inference risk having their model outputs corrupted, potentially poisoning downstream business decisions and analytics. The vulnerability affects teams across data science, autonomous systems, and recommendation platforms that rely on GPU-accelerated deep-learning inference. With no patch currently available and CISA identifying the vulnerability as automatable, affected organizations must implement immediate interim controls to maintain inference integrity.
No vendor-released patch identified at time of analysis. Interim mitigations include network segmentation of GPU inference clusters to restrict attacker access, implementation of inference output validation with anomaly detection to identify compromised results, disabling non-critical TensorRT-dependent services where feasible, and comprehensive logging of all inference processes to enable forensic analysis of potential data tampering.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Local code execution in NVIDIA TensorRT is possible when the library parses an attacker-supplied input (such as a crafte
Code execution in NVIDIA TensorRT is possible when the SDK processes a maliciously crafted input that overflows a heap-b
Improper array index validation (CWE-129) in NVIDIA TensorRT allows an attacker to trigger out-of-bounds memory access t
Code execution in NVIDIA TensorRT (all versions through v10.16.1) arises from unsafe deserialization of untrusted data (
Exploit-DB