NVIDIA TensorRT CVE-2026-24268

Exploitation requires the attacker to get NVIDIA TensorRT to parse attacker-controlled input (a crafted model, ONNX, or serialized engine/plan file) on the local system, and per the CVSS vector requires user interaction (UI:R) - meaning a user or application must actively load/process the malicious file; it is not remotely triggerable without that step (AV:L). No prior privileges or authentication are needed on TensorRT itself (PR:N). What limits exploitation: the malicious content must reach a local TensorRT process and be deliberately processed, so environments that only run first-party, integrity-verified models are largely insulated, whereas multi-tenant inference services, model marketplaces, and CI pipelines that build engines from externally supplied models are the realistic exposure. The specific vulnerable code path (which parser/deserializer) is not detailed in the provided description and should be confirmed from the NVIDIA advisory.

The signals are moderately aligned rather than alarming: CVSS 7.8 (HIGH) reflects strong technical impact (C:H/I:H/A:H) but is bounded by AV:L (local vector) and UI:R (the victim must load the malicious input), which meaningfully lowers real-world exploitability versus a network-facing flaw. No KEV listing and no EPSS score were provided, and no public proof-of-concept is referenced, so there is no evidence of active or imminent mass exploitation - the practical risk is concentrated where TensorRT loads untrusted models (model marketplaces, multi-tenant inference, CI pipelines building engines from external artifacts). Note a nuance: PR:N in the vector means no privileges are needed, but AV:L plus UI:R means exploitation still hinges on delivering a malicious file to a local process and having it processed, so this behaves more like a malicious-content/opening-a-file bug than a remote drive-by. Missing data to flag explicitly: no EPSS, no KEV, and no fixed-version string are present in the input, so prioritization should treat this as a patch-when-available issue for environments that ingest external models, and higher priority specifically for those handling untrusted model files.

An attacker crafts a malicious TensorRT engine/plan or model file and delivers it to a victim - for example by uploading it to a shared model repository, an inference service that accepts user-supplied models, or a developer's build pipeline. When the local TensorRT process deserializes or parses the file, the heap-based buffer overflow is triggered, corrupting memory and allowing the attacker to execute code in the context of the inference application. No public proof-of-concept is referenced, and the AV:L/UI:R vector means the attacker relies on the victim actually loading the crafted input.