EUVD-2026-44464
GHSA-3mvq-5wh9-4r44
Severity by source
AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Local-only vector and high privilege requirement reflect that exploitation depends on operator-level access to the code generation pipeline, not network reachability.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause improper control of code generation. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
AnalysisAI
Improper control of code generation in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allows a locally authenticated, high-privileged attacker to influence the code generation pipeline under complex, interaction-dependent conditions, potentially leading to arbitrary code execution, data tampering, and information disclosure. Despite the high CIA impact ratings, the attack prerequisites - local access, high privileges, high complexity, and required user interaction - severely constrain real-world exploitability. No public exploit exists, EPSS sits at the 2nd percentile (0.12%), and CISA SSVC records exploitation status as none.
Technical ContextAI
TensorRT-LLM is NVIDIA's open-source C++/Python inference optimization library for large language models on NVIDIA GPUs, performing JIT CUDA kernel generation and model compilation at runtime. CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) identifies the root cause: the framework fails to adequately constrain what code is generated or loaded during its compilation or inference pipeline, allowing attacker-controlled inputs to influence generated code. This class of flaw commonly manifests in JIT compilers, template engines, or build systems where externally influenced paths or inputs reach code generation logic without sufficient sanitization. The affected CPE is cpe:2.3:a:nvidia:tensorrt-llm:*:*:*:*:*:*:*:*, covering all tracked versions. The vulnerability is Linux-platform-specific.
RemediationAI
Users should upgrade to a version of TensorRT-LLM beyond v1.3.0 rc12 once a patched release is published by NVIDIA; no exact fixed version number is confirmed in the available data, so monitor NVIDIA's security bulletin page for a formal advisory. Upstream fix availability should be verified against the NVIDIA TensorRT-LLM GitHub repository release tags. As compensating controls pending a patch, restrict access to TensorRT-LLM runtime environments to explicitly trusted administrators - exploiting this flaw requires PR:H, so tightening privilege boundaries directly reduces exposure. Avoid running TensorRT-LLM workloads in shared or multi-tenant compute environments where operators may be untrusted. Disabling or sandboxing the code generation pipeline (e.g., via namespace isolation or seccomp profiles) can limit blast radius if exploitation occurs, though this may affect inference performance or functionality. References: https://nvd.nist.gov/vuln/detail/CVE-2026-24226.
More in Tensorrt Llm
View allDeserialization of untrusted data in NVIDIA TensorRT-LLM across all platforms allows a local, low-privileged attacker to
Unsafe deserialization in NVIDIA TensorRT-LLM's RPC testing component allows a local high-privileged attacker to trigger
Unsafe deserialization in NVIDIA TensorRT-LLM's MPI server component allows a high-privileged local attacker to achieve
Insecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the
Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a ho
Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attack
Null pointer dereference in NVIDIA TensorRT-LLM across all supported platforms allows a local attacker to crash the appl
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (C
Missing authentication in NVIDIA TensorRT-LLM for Linux lets an attacker reach the disaggregated orchestrator's FastAPI
Server-side request forgery in NVIDIA TensorRT-LLM for Linux exposes AI inference servers to internal network pivoting v
Unsafe deserialization in NVIDIA TensorRT-LLM's visual gen server through version 1.3.0 rc11 allows a locally privileged
Missing authentication for a critical function in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allow
Share
External POC / Exploit Code
Leaving vuln.today