EUVD-2026-44462
GHSA-6f54-qhg5-fhhf
Severity by source
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Local access and high OS privileges required to reach zeroMQ endpoint; high complexity reflects need to craft valid malicious serialized payload; code execution yields full C/I/A impact.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
1DescriptionCVE.org
NVIDIA TensorRT-LLM for any platform contains a vulnerability in visual gen server, where an attacker could cause an unsafe deserialization by unauthorized zeroMQ deserialization. A successful exploit of this vulnerability might lead to code execution.
AnalysisAI
Unsafe deserialization in NVIDIA TensorRT-LLM's visual gen server through version 1.3.0 rc11 allows a locally privileged attacker to submit malicious payloads over the zeroMQ channel and achieve arbitrary code execution. The vulnerability stems from the visual gen server accepting and deserializing zeroMQ messages without enforcing adequate authorization controls, exposing CWE-502 deserialization risks. No public exploit has been identified at time of analysis, EPSS rates exploitation probability at 0.22% (12th percentile), and SSVC confirms no known active exploitation - though technical impact is rated total given full C/I/A compromise potential.
Technical ContextAI
TensorRT-LLM is NVIDIA's high-performance inference engine for large language models, and its visual gen server component uses ZeroMQ - a high-throughput asynchronous messaging library - as an inter-process communication layer. The CPE string cpe:2.3:a:nvidia:tensorrt-llm:*:*:*:*:*:*:*:* covers all platform variants. CWE-502 (Deserialization of Untrusted Data) identifies the root cause class: the server deserializes incoming zeroMQ messages without sufficient validation of the serialized data structure or verification of the sender's authorization, a well-understood attack surface where specially crafted objects can redirect control flow during deserialization and achieve code execution. The 'unauthorized' qualifier in the description implies the zeroMQ endpoint lacks access controls that would ordinarily gate which processes can submit serializable payloads, expanding the reach of the attack surface beyond its intended design.
RemediationAI
Upgrade TensorRT-LLM to a version beyond 1.3.0 rc11 once NVIDIA publishes a patched release; no specific fixed version number is confirmed in the currently available data, so monitor the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-24220 and the NVIDIA Product Security page for patch announcements. As an interim compensating control, restrict access to the visual gen server's zeroMQ endpoint using host-based firewall rules or OS-level socket permissions so that only the intended authorized processes can communicate with it - this directly addresses the 'unauthorized deserialization' root cause without disabling the service. If the visual gen server is not required for the deployment's workload, disabling or removing it eliminates the attack surface entirely, though this sacrifices visual generation functionality. Avoid exposing TensorRT-LLM inference services in multi-tenant environments without process-level isolation until a patch is confirmed.
More in Tensorrt Llm
View allDeserialization of untrusted data in NVIDIA TensorRT-LLM across all platforms allows a local, low-privileged attacker to
Unsafe deserialization in NVIDIA TensorRT-LLM's RPC testing component allows a local high-privileged attacker to trigger
Unsafe deserialization in NVIDIA TensorRT-LLM's MPI server component allows a high-privileged local attacker to achieve
Insecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the
Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a ho
Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attack
Null pointer dereference in NVIDIA TensorRT-LLM across all supported platforms allows a local attacker to crash the appl
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (C
Missing authentication in NVIDIA TensorRT-LLM for Linux lets an attacker reach the disaggregated orchestrator's FastAPI
Server-side request forgery in NVIDIA TensorRT-LLM for Linux exposes AI inference servers to internal network pivoting v
Missing authentication for a critical function in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allow
Improper control of code generation in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allows a locally
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today