EUVD-2026-44453
GHSA-472c-jr5h-crh5
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Write-what-where reachable only via local process access with memory-shaping needed gives AV:L and AC:H; a controllable arbitrary write yields full C/I/A High impact within an unchanged scope.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a write-what-where condition. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure.
Articles & Coverage 1
AnalysisAI
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (CWE-123), enabling arbitrary memory writes that can corrupt data, crash the inference service, or leak sensitive information. The flaw carries a CVSS 7.4 (High) score with a local attack vector and high attack complexity, and affects the TensorRT-LLM library used to build and serve optimized large-language-model inference on NVIDIA GPUs. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
TensorRT-LLM is NVIDIA's open-source library for compiling and serving large language models with optimized inference kernels on NVIDIA GPUs, typically integrated into Python/C++ serving stacks and Triton-based deployment pipelines. The root cause is CWE-123 (Write-What-Where Condition): the code allows an attacker to control both the destination address and the value written to memory, usually stemming from unvalidated indices, offsets, sizes, or deserialized inputs feeding into a pointer or buffer write. Such a primitive is powerful because it can be used to overwrite function pointers, control structures, or adjacent data. The single CPE (cpe:2.3:a:nvidia:tensorrt-llm) confirms only the TensorRT-LLM application is implicated, with no version boundary published in the provided data.
RemediationAI
No vendor-released patch identified at time of analysis in the provided data - check NVIDIA's official security bulletin for TensorRT-LLM and upgrade to the fixed release once published (the CVE was reported by NVIDIA, so a vendor advisory is expected). Until a patched version is confirmed, apply compensating controls: restrict local and process-level access to hosts running TensorRT-LLM so only trusted operators can reach the inference process (reduces the AV:L exposure, at the cost of tighter operational access); treat model artifacts, tokenizer files, and inference inputs as untrusted and validate or sandbox them, since a write-what-where is often driven by crafted input or serialized data (trade-off: added validation/latency in the serving path); run the inference service under a least-privilege, isolated account or container to limit the blast radius of a successful memory write; and monitor for crashes or abnormal restarts of the serving process as a DoS indicator. Reference the NVD/CVE.org records above and NVIDIA's advisory for the authoritative fix version.
More in Tensorrt Llm
View allDeserialization of untrusted data in NVIDIA TensorRT-LLM across all platforms allows a local, low-privileged attacker to
Unsafe deserialization in NVIDIA TensorRT-LLM's RPC testing component allows a local high-privileged attacker to trigger
Unsafe deserialization in NVIDIA TensorRT-LLM's MPI server component allows a high-privileged local attacker to achieve
Insecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the
Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a ho
Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attack
Null pointer dereference in NVIDIA TensorRT-LLM across all supported platforms allows a local attacker to crash the appl
Missing authentication in NVIDIA TensorRT-LLM for Linux lets an attacker reach the disaggregated orchestrator's FastAPI
Server-side request forgery in NVIDIA TensorRT-LLM for Linux exposes AI inference servers to internal network pivoting v
Unsafe deserialization in NVIDIA TensorRT-LLM's visual gen server through version 1.3.0 rc11 allows a locally privileged
Missing authentication for a critical function in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allow
Improper control of code generation in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allows a locally
Same weakness CWE-123 – Write-what-where Condition
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today