EUVD-2026-44468
GHSA-g9r5-q2vr-2xj3
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Local-only gRPC access (AV:L), no privileges or interaction required (PR:N, UI:N), with availability-only DoS impact (A:H, C:N, I:N).
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
1DescriptionCVE.org
NVIDIA TensorRT-LLM for any platform contains a vulnerability in the gRPC server chat API endpoint, where an attacker could cause CWE-20 by local attack. A successful exploit of this vulnerability might lead to denial of service.
AnalysisAI
NVIDIA TensorRT-LLM versions through v1.3.0 rc14 exposes a gRPC server chat API endpoint susceptible to improper input validation (CWE-20), enabling a local attacker to crash the inference service and cause denial of service. The impact is strictly limited to availability - no code execution, confidentiality breach, or integrity compromise is possible. No public exploit code exists, EPSS sits at the 2nd percentile (0.12%), and CISA SSVC rates exploitation as 'none' with technical impact as 'partial', collectively indicating low urgency despite the moderate CVSS 6.2 score.
Technical ContextAI
TensorRT-LLM is NVIDIA's open-source library for optimizing and serving large language model inference, commonly deployed with a gRPC server interface for high-throughput AI workloads. The vulnerable component is the gRPC server's chat API endpoint, where user-supplied input is not properly validated before processing - a CWE-20 (Improper Input Validation) root cause, meaning the server fails to adequately check, sanitize, or constrain incoming data before acting on it. CPE data (cpe:2.3:a:nvidia:tensorrt-llm:*:*:*:*:*:*:*:*) confirms all versions from 0.0 through v1.3.0 rc14 across any platform are affected. The local attack vector (AV:L) indicates the vulnerable gRPC endpoint is only reachable from the local host - consistent with the service binding to a loopback interface - rather than being directly exploitable over a wide-area network.
RemediationAI
Upgrade NVIDIA TensorRT-LLM to a release beyond v1.3.0 rc14, which is the last version confirmed vulnerable. The exact patched version is not independently confirmed in the available references - consult NVIDIA's security advisory page and the official TensorRT-LLM GitHub repository releases page for the definitive fixed build. As a compensating control prior to patching, ensure the gRPC server is bound exclusively to the loopback interface (127.0.0.1) rather than any externally reachable interface; this limits exposure to processes already present on the host and reduces lateral-movement risk. If co-tenant or multi-user access to the host is a concern, restrict OS-level access to the gRPC port using iptables or a host-based firewall, allowing only trusted service accounts. Note that these network-layer controls mitigate exposure but do not address the underlying validation flaw.
More in Tensorrt Llm
View allDeserialization of untrusted data in NVIDIA TensorRT-LLM across all platforms allows a local, low-privileged attacker to
Unsafe deserialization in NVIDIA TensorRT-LLM's RPC testing component allows a local high-privileged attacker to trigger
Unsafe deserialization in NVIDIA TensorRT-LLM's MPI server component allows a high-privileged local attacker to achieve
Insecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the
Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a ho
Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attack
Null pointer dereference in NVIDIA TensorRT-LLM across all supported platforms allows a local attacker to crash the appl
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (C
Missing authentication in NVIDIA TensorRT-LLM for Linux lets an attacker reach the disaggregated orchestrator's FastAPI
Server-side request forgery in NVIDIA TensorRT-LLM for Linux exposes AI inference servers to internal network pivoting v
Unsafe deserialization in NVIDIA TensorRT-LLM's visual gen server through version 1.3.0 rc11 allows a locally privileged
Missing authentication for a critical function in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allow
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today