EUVD-2026-44451
GHSA-33qc-w569-hr38
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Deserializing an attacker-supplied tensor needs no auth (PR:N) or interaction, but adjacent reachability (AV:A) and difficult heap grooming (AC:H) apply, with full C/I/A impact from memory corruption.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA TensorRT-LLM for any platform contains a vulnerability in tensor deserialization, where an attacker could cause a heap based buffer overflow. A successful exploit of this vulnerability might lead to information disclosure, data tampering, or denial of service.
Articles & Coverage 1
AnalysisAI
Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attacker corrupt heap memory by supplying a crafted serialized tensor, potentially causing information disclosure, data tampering, or denial of service. All platforms running affected TensorRT-LLM versions are impacted. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; NVIDIA rates exploitation as high-complexity (AC:H).
Technical ContextAI
TensorRT-LLM is NVIDIA's open-source library for optimizing and serving large language model inference on NVIDIA GPUs, and it exchanges tensor data through serialized binary structures. The root cause is CWE-122 (Heap-Based Buffer Overflow): during deserialization the code trusts attacker-influenced size or shape metadata inside the serialized tensor and writes past the bounds of a heap allocation. Because deserialization occurs before the payload's structure is fully validated, malformed length or dimension fields drive an out-of-bounds heap write that can corrupt adjacent allocations or control data. The single affected CPE is cpe:2.3:a:nvidia:tensorrt-llm:*:*:*:*:*:*:*:* (version-agnostic in NVD at this time).
RemediationAI
No vendor-released patch identified at time of analysis, so consult NVIDIA's official security bulletin for TensorRT-LLM (linked via the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-47471 and https://www.cve.org/CVERecord?id=CVE-2026-47471) and upgrade to the fixed release once published. As compensating controls given the adjacent-network vector, restrict network access to any TensorRT-LLM serving endpoint to trusted hosts by segmenting the inference service onto an isolated management or GPU network, and treat all serialized tensors and model artifacts as untrusted by loading tensors only from integrity-verified sources rather than accepting them from arbitrary clients. If a remote tensor-ingest or deserialization feature is not required, disable or firewall it; the trade-off is loss of any legitimate remote tensor-exchange functionality until the patched version is deployed.
More in Tensorrt Llm
View allDeserialization of untrusted data in NVIDIA TensorRT-LLM across all platforms allows a local, low-privileged attacker to
Unsafe deserialization in NVIDIA TensorRT-LLM's RPC testing component allows a local high-privileged attacker to trigger
Unsafe deserialization in NVIDIA TensorRT-LLM's MPI server component allows a high-privileged local attacker to achieve
Insecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the
Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a ho
Null pointer dereference in NVIDIA TensorRT-LLM across all supported platforms allows a local attacker to crash the appl
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (C
Missing authentication in NVIDIA TensorRT-LLM for Linux lets an attacker reach the disaggregated orchestrator's FastAPI
Server-side request forgery in NVIDIA TensorRT-LLM for Linux exposes AI inference servers to internal network pivoting v
Unsafe deserialization in NVIDIA TensorRT-LLM's visual gen server through version 1.3.0 rc11 allows a locally privileged
Missing authentication for a critical function in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allow
Improper control of code generation in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allows a locally
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today