EUVD-2026-44451
GHSA-33qc-w569-hr38
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent-network access to TensorRT-LLM service
-
DeliveryCraft malicious serialized tensor
-
ExploitSubmit tensor to deserialization endpoint
-
ExecutionTrigger heap buffer overflow
-
PersistCorrupt heap memory
-
ImpactLeak data, tamper, or crash service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to reach the tensor deserialization code path with a maliciously crafted serialized tensor, meaning the target must accept and deserialize attacker-supplied tensor data. Per the CVSS vector (AV:A) the attacker must be on the same adjacent/local network as the affected TensorRT-LLM instance rather than the open internet, and no authentication (PR:N) or user interaction (UI:N) is needed against an exposed deserialization interface. The key limiting factors are adjacent-network reachability and high attack complexity (AC:H) - reliable heap-overflow exploitation demands precise control of allocation state - so realistic risk is confined to environments where the inference/deserialization endpoint is exposed to an attacker on the local network. |
| Impact | The CVSS 3.1 base score is 7.5 (High) with vector AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no authentication or user interaction is required but the attacker must be on an adjacent network and overcome high attack complexity - consistent with the difficulty of reliably grooming a heap overflow. All three impact metrics are High, so a successful exploit threatens confidentiality, integrity, and availability at once. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input; the absence of KEV and public exploit code combined with AC:H suggests a real but non-trivial issue rather than a mass-exploitation candidate. Note the tension between the AV:A (adjacent) rating and the deserialization root cause plus 'for any platform' framing, which often implies the attacker must deliver a crafted artifact to the deserializer - verify the exact exposure (network-facing service vs. loaded model/tensor file) with NVIDIA before finalizing priority. |
| Exploit ScenarioDerived | An attacker positioned on the same adjacent network as a TensorRT-LLM inference service sends a crafted serialized tensor whose size/shape metadata is malformed to the deserialization routine. The oversized fields trigger a heap-based buffer overflow, and after careful heap grooming (reflecting the high attack complexity) the attacker leaks adjacent memory, tampers with in-memory data, or crashes the service. No public proof-of-concept was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attacker corrupt heap memory by supplying a crafted serialized tensor, potentially causing information disclosure, data tampering, or denial of service. All platforms running affected TensorRT-LLM versions are impacted. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; NVIDIA rates exploitation as high-complexity (AC:H).
RemediationAI
No vendor-released patch identified at time of analysis, so consult NVIDIA's official security bulletin for TensorRT-LLM (linked via the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-47471 and https://www.cve.org/CVERecord?id=CVE-2026-47471) and upgrade to the fixed release once published. As compensating controls given the adjacent-network vector, restrict network access to any TensorRT-LLM serving endpoint to trusted hosts by segmenting the inference service onto an isolated management or GPU network, and treat all serialized tensors and model artifacts as untrusted by loading tensors only from integrity-verified sources rather than accepting them from arbitrary clients. If a remote tensor-ingest or deserialization feature is not required, disable or firewall it; the trade-off is loss of any legitimate remote tensor-exchange functionality until the patched version is deployed.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TensorRT-LLM is NVIDIA's open-source library for optimizing and serving large language model inference on NVIDIA GPUs, and it exchanges tensor data through serialized binary structures. The root cause is CWE-122 (Heap-Based Buffer Overflow): during deserialization the code trusts attacker-influenced size or shape metadata inside the serialized tensor and writes past the bounds of a heap allocation. Because deserialization occurs before the payload's structure is fully validated, malformed length or dimension fields drive an out-of-bounds heap write that can corrupt adjacent allocations or control data. The single affected CPE is cpe:2.3:a:nvidia:tensorrt-llm:*:*:*:*:*:*:*:* (version-agnostic in NVD at this time).
Know when Tensorrt Llm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Deserializing an attacker-supplied tensor needs no auth (PR:N) or interaction, but adjacent reachability (AV:A) and difficult heap grooming (AC:H) apply, with full C/I/A impact from memory corruption.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
DescriptionCVE.org
NVIDIA TensorRT-LLM for any platform contains a vulnerability in tensor deserialization, where an attacker could cause a heap based buffer overflow. A successful exploit of this vulnerability might lead to information disclosure, data tampering, or denial of service.
Articles & Coverage 1
Executive ViewAI
NVIDIA TensorRT-LLM deployments face a heap overflow vulnerability allowing adjacent, unauthenticated attackers to corrupt memory and disrupt AI inference-affecting organizations relying on TensorRT-LLM for production model serving. No public exploit is identified at time of analysis, but the absence of vendor patches demands immediate network and operational controls. This impacts both system availability and data integrity for deployed AI models.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) network segmentation-restrict access to TensorRT-LLM services to trusted adjacent networks only, as exploitation requires adjacent network positioning; (2) input validation-implement strict sanitization and validation of serialized tensor inputs; (3) service restriction-disable TensorRT-LLM if not business-critical; (4) monitoring-log and alert on anomalous tensor deserialization activity and failed validation attempts. Maintain continuous watch for NVIDIA patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Tensorrt Llm
View allDeserialization of untrusted data in NVIDIA TensorRT-LLM across all platforms allows a local, low-privileged attacker to
Unsafe deserialization in NVIDIA TensorRT-LLM's RPC testing component allows a local high-privileged attacker to trigger
Unsafe deserialization in NVIDIA TensorRT-LLM's MPI server component allows a high-privileged local attacker to achieve
Insecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the
TensorRT-LLM 1.3.0rc24 can load a tokenizer from an attacker-influenced location during KvCacheAwareRouter initializatio
Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a ho
Null pointer dereference in NVIDIA TensorRT-LLM across all supported platforms allows a local attacker to crash the appl
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (C
Missing authentication in NVIDIA TensorRT-LLM for Linux lets an attacker reach the disaggregated orchestrator's FastAPI
Server-side request forgery (SSRF) in NVIDIA TensorRT-LLM 1.3.0rc24 allows an attacker who can reach a local input vecto
Server-side request forgery (CWE-918) in NVIDIA TensorRT-LLM, reported by NVIDIA at CVSS 7.1, allows an attacker positio
Server-side request forgery in NVIDIA TensorRT-LLM for Linux exposes AI inference servers to internal network pivoting v
Exploit-DB