EUVD-2026-110820
GHSA-8wpc-qj5h-77gc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessStage malicious tokenizer in trusted-load path
-
ExploitKvCacheAwareRouter loads untrusted tokenizer
-
ExecutionUntrusted functionality incorporated at load
-
ImpactCode execution / data disclosure / DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Trusted source inclusion only
|
| Exploitation Conditions | Exploitation requires the TensorRT-LLM KvCacheAwareRouter to load a tokenizer from a source the attacker can control or influence (CWE-829 inclusion of functionality from an untrusted control sphere); the described trigger is specifically the tokenizer-loading step in that router. The CVSS AV:L vector means the untrusted tokenizer must be reachable within the local loading path rather than delivered over an arbitrary network connection, and the flaw affects deployments that actually use the KvCacheAwareRouter - environments not using this routing component or loading only trusted/verified tokenizers are not in the exploitable path. No special authentication is modeled (PR:N) and no user interaction is required (UI:N) once the untrusted tokenizer is in the load path. The affected version indicated is TensorRT-LLM 1.3.0rc24. |
| Impact | This is a vendor-reported (NVIDIA) flaw with a CVSS base score of 8.4 driven by a high triple-impact (C:H/I:H/A:H) but a LOCAL attack vector (AV:L). The combination of AV:L with PR:N/UI:N is notable: it means no authentication or user interaction is modeled, yet the attack is not remote over the network - exploitation occurs in the local loading path where an untrusted tokenizer is incorporated (CWE-829, inclusion of functionality from an untrusted control sphere). No EPSS score was supplied in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no verified exploit code is provided - the only references are the NVD/CVE records and NVIDIA's product-security advisory page. The vuln.today decision label is 'this_week', indicating elevated-but-not-emergency urgency consistent with a high-severity vendor advisory lacking confirmed active exploitation. Net assessment: a genuinely high-severity issue for environments that run TensorRT-LLM with the KvCacheAwareRouter and load tokenizers from sources an attacker can influence, but real-world risk is bounded by the local vector and the specific deployment prerequisite rather than being broadly remotely exploitable. The AV:L vector should be verified against deployment reality - if the router ever loads tokenizer data derived from network-reachable or multi-tenant input, effective reachability may be broader than AV:L alone implies. |
| Exploit ScenarioDerived | An attacker supplies or influences a malicious tokenizer artifact that NVIDIA TensorRT-LLM's KvCacheAwareRouter loads, causing untrusted functionality to be incorporated into the inference process. When the tokenizer is loaded, the attacker-controlled content executes or alters behavior, potentially yielding code execution, disclosure of model/host data, data tampering, or denial of service. No public exploit identified at time of analysis; the attack requires the local loading path to reach the attacker-controlled tokenizer. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
TensorRT-LLM 1.3.0rc24 can load a tokenizer from an attacker-influenced location during KvCacheAwareRouter initialization, allowing inclusion of functionality from an untrusted control sphere (CWE-829). Because the CVSS vector is AV:L with PR:N and UI:N, the untrusted tokenizer must be reachable inside the local loading path, but once it is, no credentials or user interaction are needed; successful exploitation can yield code execution, information disclosure, data tampering, and denial of service. NVIDIA reports the issue with a base score of 8.4, and no public exploit code or confirmed active exploitation was identified at time of analysis. Only deployments that actually use the KvCacheAwareRouter and load tokenizers from unverified sources sit in the exploitable path.
RemediationAI
NVIDIA issued this through its product-security process, and the advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5883 should be consulted for the fixed TensorRT-LLM release; the available data lists TensorRT-LLM 1.3.0rc24 as the affected version but does not state an exact patched version, so the vendor advisory is the authoritative source before upgrading. Until a fixed build is deployed, restrict exposure by ensuring KvCacheAwareRouter only loads tokenizer artifacts from trusted, verified local paths with integrity checks, since a tokenizer from an untrusted control sphere is the exploitation precondition; environments that do not use this routing component avoid the vulnerable path entirely, though that may limit functionality. Because exploitation requires the untrusted tokenizer to be reachable within the local loading path (AV:L), limiting filesystem and artifact-repository write access for unprivileged users and CI jobs reduces the attack surface. Review the advisory's version guidance before assuming the current release is patched.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TensorRT-LLM is NVIDIA's library for optimized large language model inference, and KvCacheAwareRouter is a routing component that dispatches requests across inference workers while accounting for KV-cache locality. That router loads a tokenizer as part of its operation, and the flaw is a CWE-829 (inclusion of functionality from an untrusted control sphere) defect in that loading step: the component can pick up tokenizer artifacts from a location the attacker influences instead of a verified, trusted one. Tokenizer loading in Python-based ML stacks typically involves deserialization and configuration files, so pulling those artifacts from an untrusted source expands the attack surface from data handling into potential code execution, plus disclosure and tampering of model/user data. The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects that the untrusted tokenizer has to be reachable through the local loading path - the flaw is not modeled as remotely reachable over an arbitrary network connection - while the complexity of the attack itself is low and no privileges or interaction are required once that precondition holds. Per the available data, the affected version is TensorRT-LLM 1.3.0rc24; the vulnerable trigger is specifically the tokenizer-loading step in KvCacheAwareRouter, and the underlying mechanism beyond that is not described in the available sources. Environments that do not use this routing component, or that load only trusted and verified tokenizers, are not in the exploitable path.
Know when Tensorrt Llm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Tokenizer loading is a local/config-driven path so AV:L; no auth or interaction is modeled (PR:N/UI:N), and untrusted functionality inclusion plausibly yields full C:H/I:H/A:H.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
DescriptionCVE.org
NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusion of functionality from an untrusted control sphere. A successful exploit might lead to code execution, information disclosure, data tampering, and denial of service.
Executive ViewAI
A high-severity vulnerability in TensorRT-LLM version 1.3.0rc24 allows a local attacker to influence tokenizer loading during KvCacheAwareRouter initialization, potentially leading to code execution, data exposure, tampering, and denial of service. Only deployments that use KvCacheAwareRouter and load tokenizers from untrusted locations are at risk. Security leadership should prioritize identifying affected systems and restricting tokenizer sources to prevent compromise of AI inference workloads.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict local file system access to tokenizer directories, use only tokenizers from trusted sources with integrity verification, disable KvCacheAwareRouter if not essential, and monitor for unauthorized changes to tokenizer files and suspicious process execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Tensorrt Llm
View allDeserialization of untrusted data in NVIDIA TensorRT-LLM across all platforms allows a local, low-privileged attacker to
Unsafe deserialization in NVIDIA TensorRT-LLM's RPC testing component allows a local high-privileged attacker to trigger
Unsafe deserialization in NVIDIA TensorRT-LLM's MPI server component allows a high-privileged local attacker to achieve
Insecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the
Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a ho
Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attack
Null pointer dereference in NVIDIA TensorRT-LLM across all supported platforms allows a local attacker to crash the appl
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (C
Missing authentication in NVIDIA TensorRT-LLM for Linux lets an attacker reach the disaggregated orchestrator's FastAPI
Server-side request forgery (SSRF) in NVIDIA TensorRT-LLM 1.3.0rc24 allows an attacker who can reach a local input vecto
Server-side request forgery (CWE-918) in NVIDIA TensorRT-LLM, reported by NVIDIA at CVSS 7.1, allows an attacker positio
Server-side request forgery in NVIDIA TensorRT-LLM for Linux exposes AI inference servers to internal network pivoting v
Exploit-DB