EUVD-2026-44449
GHSA-g2v9-2grm-8qxj
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description's 'local same-user access' maps to AV:L and PR:L; unsafe deserialization plausibly yields full code execution, so C/I/A all High and AC:L.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA TensorRT-LLM contains a vulnerability in its inter-process communication layer where an attacker with local same-user access could cause deserialization. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.
Articles & Coverage 1
AnalysisAI
Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a host running the inference stack abuse its inter-process communication layer to trigger unsafe object deserialization (CWE-502), potentially yielding code execution, information disclosure, data tampering, and denial of service. The flaw is vendor-reported by NVIDIA and carries a CVSS 3.1 base of 7.8 (AV:L), meaning it is not remotely reachable but converts existing local access into full compromise of the model-serving process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
TensorRT-LLM is NVIDIA's open-source library for optimizing and serving large language models on GPUs, commonly deployed as a Python/C++ inference runtime that uses inter-process communication (IPC) to coordinate worker processes (for example across tensor/pipeline-parallel GPU workers). The root cause is CWE-502, Deserialization of Untrusted Data: the IPC channel deserializes objects (typically via Python pickle or a similar mechanism used to pass tensors/commands between processes) without validating that the serialized payload is trustworthy. When an attacker running as the same local user can write to or inject into that IPC channel, crafted serialized data is reconstructed into live objects, allowing attacker-controlled code paths to execute. The CPE cpe:2.3:a:nvidia:tensorrt-llm:*:*:*:*:*:*:*:* indicates all versions are in scope pending a fixed release identifier.
RemediationAI
No vendor-released patch version was identified in the provided data, so the primary action is to monitor NVIDIA's security bulletin channel (typically https://nvidia.custhelp.com / the NVIDIA Product Security page) referenced from the CVE and upgrade TensorRT-LLM to the fixed release as soon as NVIDIA publishes it, then track the CVE via https://nvd.nist.gov/vuln/detail/CVE-2026-47472. Because exploitation requires same-user local access, effective compensating controls focus on tightening the local trust boundary: run TensorRT-LLM under a dedicated low-privilege service account isolated from other users and workloads (limits blast radius but requires deployment changes), restrict filesystem permissions and directory ownership on any IPC sockets, named pipes, or shared-memory/temp paths so only the intended process user can access them, and isolate the inference runtime in a hardened container or namespace to prevent co-tenant processes from reaching the IPC channel (adds operational overhead and may complicate multi-worker GPU setups). Avoid running the runtime on multi-tenant hosts where untrusted users share the same UID, and verify exact fix versions from NVIDIA before deploying rather than assuming any version string.
More in Tensorrt Llm
View allDeserialization of untrusted data in NVIDIA TensorRT-LLM across all platforms allows a local, low-privileged attacker to
Unsafe deserialization in NVIDIA TensorRT-LLM's RPC testing component allows a local high-privileged attacker to trigger
Unsafe deserialization in NVIDIA TensorRT-LLM's MPI server component allows a high-privileged local attacker to achieve
Insecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the
Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attack
Null pointer dereference in NVIDIA TensorRT-LLM across all supported platforms allows a local attacker to crash the appl
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (C
Missing authentication in NVIDIA TensorRT-LLM for Linux lets an attacker reach the disaggregated orchestrator's FastAPI
Server-side request forgery in NVIDIA TensorRT-LLM for Linux exposes AI inference servers to internal network pivoting v
Unsafe deserialization in NVIDIA TensorRT-LLM's visual gen server through version 1.3.0 rc11 allows a locally privileged
Missing authentication for a critical function in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allow
Improper control of code generation in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allows a locally
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today