EUVD-2026-94047
GHSA-33m9-4v26-qccr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malformed TensorRT model file
-
ExploitDeliver and induce victim to load
-
ExecutionTrigger out-of-bounds read in parser
-
ImpactCrash inference process (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an application using NVIDIA TensorRT to parse an attacker-supplied, maliciously crafted model or serialized engine file; the AV:L and UI:R metrics mean there is no remote or autonomous trigger - a local user or local process must actively load the malicious input. Limiting factors: the attacker must first deliver the crafted file and get the victim/application to process it, there is no network-reachable attack surface, no privilege escalation or data exposure results (A:H only), and impact is confined to crashing the TensorRT process. |
| Impact | This is a moderate-severity, low-urgency issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, score 5.5) describes a locally-triggered flaw requiring user interaction, with impact limited exclusively to availability (denial of service) - no confidentiality or integrity impact. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public proof-of-concept was referenced, so there is no evidence of active or imminent exploitation. There is a notable conflict between signals: the input Tags include 'Information Disclosure', but the CVSS vector sets C:N (no confidentiality impact) and the NVIDIA description states the result is denial of service only - out-of-bounds reads (CWE-125) can sometimes leak memory, but the authoritative NVD vector does not credit any confidentiality impact, so the 'Information Disclosure' tag should be treated as unverified. Overall this is a genuine but low-priority defect: the local attack vector plus required user interaction and DoS-only impact keep real-world risk modest, and it does not warrant emergency patching absent evidence of exploitation. |
| Exploit ScenarioDerived | An attacker crafts a malformed deep-learning model or serialized engine file and induces a victim to load it into an application built on NVIDIA TensorRT (for example via a shared model artifact or a model-hosting pipeline). When TensorRT parses the crafted input, it performs an out-of-bounds read that crashes the inference process, causing denial of service. No public exploit code was identified at time of analysis, and the local vector with required user interaction limits the scenario to targeted delivery of a malicious file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Out-of-bounds read in NVIDIA TensorRT can crash the inference runtime when an application parses an attacker-supplied, maliciously crafted model or serialized engine file, yielding denial of service limited to the affected process. The flaw is rated CVSS 5.5 (CWE-125, AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), meaning it is not remotely reachable: a local user or local process must deliberately load the crafted input, and no privileges are required (PR:N) although user interaction is (UI:R). There is no privilege escalation or confirmed data exposure from this vector, no public exploit identified at time of analysis, and it is not listed in CISA KEV; consistent with our assessment this is a moderate-severity, low-urgency issue best handled through routine patching and supply-chain hygiene around model/engine files.
RemediationAI
No vendor-released patch identified at time of analysis; the authoritative fix and any affected/fixed version matrix must be confirmed from NVIDIA's advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5891, and updates should be applied as soon as NVIDIA publishes them. In the interim, the highest-value compensating control is to never deserialize untrusted TensorRT models or serialized engine files: enforce strict provenance and cryptographic signature/hash verification on every .plan, engine, or model artifact before it reaches the runtime, which blocks the attack outright but adds a signing-and-key-management step to your ML pipeline. Where untrusted artifacts must still be processed, do so inside a sandboxed or containerized inference worker running as an unprivileged, non-shared user with read-only filesystem and no host mounts, so an out-of-bounds read only crashes the isolated process rather than affecting shared services - the trade-off is reduced performance and additional orchestration complexity. Additionally, restrict write access to model/engine directories to trusted build systems, and configure crash monitoring/restart limits on inference services so repeated malformed inputs are detected and rate-limited. Note these are mitigations, not fixes: they reduce exploit delivery and blast radius, but only an NVIDIA-supplied update removes the underlying CWE-125 bounds-check defect.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NVIDIA TensorRT is a high-performance deep learning inference SDK and runtime that builds optimized engines from network definitions and serializes them to disk as plan/engine files, which are subsequently deserialized and executed. The vulnerability is an out-of-bounds read (CWE-125): insufficient bounds validation when parsing a crafted model or serialized engine file causes TensorRT to read past the end of a buffer, corrupting control flow or state and terminating the process. Notably, the supplied tags reference 'Buffer Overflow' and 'Information Disclosure', but the assessed CVSS vector carries C:N - confidentiality impact is rated none, so any information disclosure is not established by the available data and should not be assumed. The AV:L and UI:R metrics confirm the attacker must both place the malicious artifact on the target and induce a user or application to load it; there is no network-reachable parsing surface in this assessment. Exploitation is therefore a local, input-driven reliability/availability concern rather than a remote code execution or data-exfiltration primitive.
Know when Nvidia gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Exploitation requires a victim to locally load a crafted model file (AV:L, UI:R) with no privileges or added complexity, and an out-of-bounds read yields a crash only, so C:N/I:N/A:H.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
DescriptionCVE.org
NVIDIA TensorRT contains a vulnerability where an attacker can cause an out of bounds read. A successful exploit of this vulnerability may lead to denial of service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres
The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary c
The NVIDIA driver before 307.78, and Release 310 before 311.00, in the NVIDIA Display Driver service on Windows does not
NVIDIA Windows GPU Display Driver (all versions) contains a vulnerability in DirectX drivers, in which a specially craft
Authentication bypass in NVIDIA Triton Inference Server allows unauthenticated remote attackers to reach protected funct
NVIDIA Windows GPU Display Driver (all versions) contains a vulnerability in DirectX drivers, in which a specially craft
NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability when used with default co
For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA GeForce Experience R340 before GFE 2.11.4.125 and R375 before G
The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and includ
The NVIDIA Graphics Drivers subsystem in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privi
NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with de
Exploit-DB