EUVD-2026-44448
GHSA-rjg7-v496-w6mx
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local vector since exploitation requires deserializing an attacker-controlled model file (AV:L); no privileges once the artifact is loaded (PR:N), with full code-execution-grade C/I/A impact.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model weight deserialization, where a local, unauthenticated attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.
Articles & Coverage 1
AnalysisAI
Insecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the restricted unpickler that handles model-weight loading, potentially achieving code execution, privilege escalation, data tampering, and information disclosure. The flaw (CWE-502, CVSS 8.4) affects the GPU LLM-inference library and stems from the restricted unpickler failing to fully constrain what can be deserialized from an untrusted model artifact. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Technical ContextAI
TensorRT-LLM is NVIDIA's open-source library for compiling and serving large language models on NVIDIA GPUs, and it loads serialized model weights during initialization. To reduce risk, NVIDIA wraps this load path in a 'restricted' unpickler intended to allow only a safe subset of Python objects; the vulnerability is that this restriction is incomplete, so a crafted pickle stream embedded in a model weight file can still trigger dangerous object reconstruction. This is a classic CWE-502 Deserialization of Untrusted Data issue: Python's pickle format can invoke arbitrary callables (via reduce/global opcodes) during unpickling, and any gap in an allowlist-based restricted unpickler reopens that primitive. The single CPE, cpe:2.3:a:nvidia:tensorrt-llm:*:*:*:*:*:*:*:*, indicates the whole product line is in scope pending a fixed release.
RemediationAI
No vendor-released patch version was identified at time of analysis in the provided data, so the primary action is to consult NVIDIA's official security bulletin for TensorRT-LLM and upgrade to the fixed release once identified (start from the NVD/CVE.org records at https://nvd.nist.gov/vuln/detail/CVE-2026-24233). As compensating controls until patched, only load model weights from trusted, integrity-verified sources - enforce checksums or signatures on model artifacts and reject files of unknown provenance, accepting the trade-off that this blocks convenient use of community/third-party model hubs; restrict filesystem and directory permissions on the model-loading path so untrusted local users cannot place or swap weight files (trade-off: tighter operational access for ML engineers); and run inference workloads in isolated, least-privilege containers or sandboxes so a successful deserialization does not yield host-level privilege escalation (trade-off: added deployment complexity and possible GPU-passthrough constraints).
More in Tensorrt Llm
View allDeserialization of untrusted data in NVIDIA TensorRT-LLM across all platforms allows a local, low-privileged attacker to
Unsafe deserialization in NVIDIA TensorRT-LLM's RPC testing component allows a local high-privileged attacker to trigger
Unsafe deserialization in NVIDIA TensorRT-LLM's MPI server component allows a high-privileged local attacker to achieve
Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a ho
Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attack
Null pointer dereference in NVIDIA TensorRT-LLM across all supported platforms allows a local attacker to crash the appl
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (C
Missing authentication in NVIDIA TensorRT-LLM for Linux lets an attacker reach the disaggregated orchestrator's FastAPI
Server-side request forgery in NVIDIA TensorRT-LLM for Linux exposes AI inference servers to internal network pivoting v
Unsafe deserialization in NVIDIA TensorRT-LLM's visual gen server through version 1.3.0 rc11 allows a locally privileged
Missing authentication for a critical function in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allow
Improper control of code generation in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allows a locally
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today