EUVD-2026-44488
GHSA-89jv-4g4v-pr3h
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local malicious-file parsing requires the victim to load input (AV:L/UI:R) with no privileges (PR:N), and memory-corruption code execution yields full C:H/I:H/A:H.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA TensorRT contains a vulnerability where an attacker might cause a heap-based buffer overflow. A successful exploit of this vulnerability might lead to code execution.
Articles & Coverage 1
AnalysisAI
Local code execution in NVIDIA TensorRT is possible when the library parses an attacker-supplied input (such as a crafted model/engine file), triggering a heap-based buffer overflow (CWE-122) that can corrupt memory and lead to arbitrary code execution in the context of the process using TensorRT. The CVSS 3.1 vector (AV:L/UI:R) indicates the attacker needs local access and must induce a user or application to load malicious content, and there is no public exploit identified at time of analysis. TensorRT is NVIDIA's deep-learning inference SDK, so the affected population is developers, MLOps pipelines, and inference servers that load third-party or untrusted models.
Technical ContextAI
TensorRT is NVIDIA's high-performance deep-learning inference optimizer and runtime that ingests trained models (e.g., ONNX) and serialized engine/plan files, builds optimized GPU execution graphs, and runs inference on NVIDIA GPUs. The root cause is CWE-122 (heap-based buffer overflow): during parsing or deserialization of input data, the code writes past the bounds of a heap-allocated buffer, typically because a length/size field or element count from the input is trusted without adequate validation against the allocation size. Because TensorRT is delivered as native C++ libraries (with Python bindings) linked into inference applications, memory corruption in the parser executes within the host application's address space rather than a sandbox. The single CPE (cpe:2.3:a:nvidia:tensorrt:*:*:*:*:*:*:*:*) is a wildcard covering all versions, so the exact fixed build must be taken from the NVIDIA advisory rather than the CPE range.
RemediationAI
Patch available per vendor advisory: consult NVIDIA security bulletin https://nvidia.custhelp.com/app/answers/detail/a_id/5855 and upgrade to the fixed TensorRT version specified there (an exact fixed version string is not present in the provided input, so verify it directly from that advisory before rollout). Until patched, the most effective compensating control is to treat model and serialized engine/plan files as untrusted code: only load models from trusted, integrity-verified sources (signed artifacts, checksums) and refuse externally supplied engine files, accepting the trade-off that this blocks model-sharing and third-party model ingestion workflows. Additional controls include running TensorRT inference in an isolated, least-privilege process or container with reduced host access so that memory corruption cannot easily pivot to the host, and gating any pipeline that builds engines from external ONNX/model uploads behind manual review - with the side effect of added latency to model-onboarding pipelines. Rebuild and redeploy any container images that bundle the vulnerable TensorRT runtime after the fixed version is available.
Code execution in NVIDIA TensorRT is possible when the SDK processes a maliciously crafted input that overflows a heap-b
Improper array index validation (CWE-129) in NVIDIA TensorRT allows an attacker to trigger out-of-bounds memory access t
Out-of-bounds write in NVIDIA TensorRT prior to version 10.16.1 allows an attacker to corrupt memory and tamper with dat
Code execution in NVIDIA TensorRT (all versions through v10.16.1) arises from unsafe deserialization of untrusted data (
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today