EUVD-2026-44453
GHSA-472c-jr5h-crh5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access to TensorRT-LLM host/process
-
DeliverySupply crafted input or model artifact
-
ExploitTrigger write-what-where via controllable offset
-
ExecutionOverwrite target memory location/pointer
-
ImpactCorrupt data, leak info, or crash service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Write-what-where prevention
|
| Exploitation Conditions | Exploitation requires local access to the system or process running NVIDIA TensorRT-LLM (AV:L) - this is not a remote, internet-facing unauthenticated flaw despite PR:N, which here reflects no formal authentication step in the modeled local path. The attack is further limited by high attack complexity (AC:H): the attacker must satisfy conditions outside their control, such as winning a race or achieving a specific memory layout/state to make the write-what-where land reliably. No user interaction is required (UI:N). The exact triggering feature (which API, deserialization path, or input field yields the controllable write) is not specified in the available description and must be confirmed from NVIDIA's advisory; treat any component that accepts external model artifacts or inference inputs on the local host as the likely exposure surface. |
| Impact | The signals are mixed and point to a real-but-not-urgent issue. The CVSS vector (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) shows full triad impact (confidentiality, integrity, availability all High) but is gated by a local attack vector and high attack complexity, meaning an attacker must already reach the host/process and satisfy non-trivial conditions to win the race or shape memory. PR:N indicates no prior authentication is modeled, but combined with AV:L this typically means access to the local system or the inference process input path rather than remote unauthenticated internet exposure. No EPSS score, no SSVC decision, no KEV listing, and no POC were supplied, so there is no evidence of active or automatable exploitation. Net: prioritize as a standard High-severity patch-when-available item, not a drop-everything emergency - the AC:H and AV:L materially reduce real-world exploitability compared to the 7.4 base number. Note the tension: PR:N with AV:L should be read carefully - verify with the vendor whether 'local' means a co-located user, a malicious model/input artifact, or an adjacent service, as this changes the exposure profile. |
| Exploit ScenarioDerived | An attacker who can supply crafted inputs or artifacts to a locally reachable TensorRT-LLM inference process manipulates a controllable offset/pointer to write an attacker-chosen value to an attacker-chosen memory location. By repeatedly shaping memory (consistent with the AC:H requirement), they corrupt a control structure to leak model or process data, tamper with outputs, or crash the service. No public POC is available at time of analysis, and the local vector plus high complexity make reliable exploitation non-trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (CWE-123), enabling arbitrary memory writes that can corrupt data, crash the inference service, or leak sensitive information. The flaw carries a CVSS 7.4 (High) score with a local attack vector and high attack complexity, and affects the TensorRT-LLM library used to build and serve optimized large-language-model inference on NVIDIA GPUs. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis in the provided data - check NVIDIA's official security bulletin for TensorRT-LLM and upgrade to the fixed release once published (the CVE was reported by NVIDIA, so a vendor advisory is expected). Until a patched version is confirmed, apply compensating controls: restrict local and process-level access to hosts running TensorRT-LLM so only trusted operators can reach the inference process (reduces the AV:L exposure, at the cost of tighter operational access); treat model artifacts, tokenizer files, and inference inputs as untrusted and validate or sandbox them, since a write-what-where is often driven by crafted input or serialized data (trade-off: added validation/latency in the serving path); run the inference service under a least-privilege, isolated account or container to limit the blast radius of a successful memory write; and monitor for crashes or abnormal restarts of the serving process as a DoS indicator. Reference the NVD/CVE.org records above and NVIDIA's advisory for the authoritative fix version.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TensorRT-LLM is NVIDIA's open-source library for compiling and serving large language models with optimized inference kernels on NVIDIA GPUs, typically integrated into Python/C++ serving stacks and Triton-based deployment pipelines. The root cause is CWE-123 (Write-What-Where Condition): the code allows an attacker to control both the destination address and the value written to memory, usually stemming from unvalidated indices, offsets, sizes, or deserialized inputs feeding into a pointer or buffer write. Such a primitive is powerful because it can be used to overwrite function pointers, control structures, or adjacent data. The single CPE (cpe:2.3:a:nvidia:tensorrt-llm) confirms only the TensorRT-LLM application is implicated, with no version boundary published in the provided data.
Know when Tensorrt Llm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Write-what-where reachable only via local process access with memory-shaping needed gives AV:L and AC:H; a controllable arbitrary write yields full C/I/A High impact within an unchanged scope.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
DescriptionCVE.org
NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a write-what-where condition. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure.
Articles & Coverage 1
Executive ViewAI
NVIDIA TensorRT-LLM, the primary framework for deploying optimized large language model inference on enterprise GPU clusters, contains a local memory corruption vulnerability (CVSS 7.4) with no public exploit identified at time of analysis. An attacker with local system access can corrupt model data, crash inference services, or exfiltrate sensitive GPU memory, creating significant availability and data integrity risks. The absence of a vendor patch requires immediate compensating controls and access restrictions for all organizations currently running this framework.
Restrict local system access through OS-level privileged access management and disable unused TensorRT-LLM services. Segment inference infrastructure from production networks and sensitive data systems, implement GPU memory corruption monitoring, enable comprehensive audit logging of system and application events, and establish continuous behavioral monitoring for unexpected service crashes or memory errors. Maintain incident response readiness and contingency plans for inference service failover or framework migration.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Tensorrt Llm
View allDeserialization of untrusted data in NVIDIA TensorRT-LLM across all platforms allows a local, low-privileged attacker to
Unsafe deserialization in NVIDIA TensorRT-LLM's RPC testing component allows a local high-privileged attacker to trigger
Unsafe deserialization in NVIDIA TensorRT-LLM's MPI server component allows a high-privileged local attacker to achieve
Insecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the
TensorRT-LLM 1.3.0rc24 can load a tokenizer from an attacker-influenced location during KvCacheAwareRouter initializatio
Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a ho
Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attack
Null pointer dereference in NVIDIA TensorRT-LLM across all supported platforms allows a local attacker to crash the appl
Missing authentication in NVIDIA TensorRT-LLM for Linux lets an attacker reach the disaggregated orchestrator's FastAPI
Server-side request forgery (SSRF) in NVIDIA TensorRT-LLM 1.3.0rc24 allows an attacker who can reach a local input vecto
Server-side request forgery (CWE-918) in NVIDIA TensorRT-LLM, reported by NVIDIA at CVSS 7.1, allows an attacker positio
Server-side request forgery in NVIDIA TensorRT-LLM for Linux exposes AI inference servers to internal network pivoting v
Exploit-DB