NVIDIA TensorRT-LLM EUVD-2026-44448

Exploitation requires that TensorRT-LLM on Linux deserialize a model weight file that the attacker controls or has tampered with - the specific trigger is the restricted-unpickler code path invoked during model-weight loading, so the attacker must be able to supply, substitute, or influence the weights the victim process loads. The Local attack vector (AV:L) is the key limiting factor: the attacker needs local access to the host or write access to the model file/directory rather than remote network reachability, which meaningfully narrows exposure to scenarios involving untrusted or shared model artifacts. Deployments that exclusively load first-party, integrity-verified weights from controlled storage are largely insulated, whereas environments that ingest third-party or user-supplied models are directly exposed; no user interaction beyond the normal model-load operation is required per the CVSS UI:N metric.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields 8.4 (High), driven by high impact across confidentiality, integrity, and availability with low attack complexity and no privileges - but critically the attack vector is Local (AV:L), not network, so this is not a remotely triggerable pre-auth RCE despite the high score. PR:N here means no authentication is needed once the attacker can influence the model artifact being loaded locally, which realistically depends on supplying or substituting a malicious model file into the load path. No EPSS score, SSVC decision, KEV entry, or POC was provided in the input, so real-world exploitation pressure cannot be quantified from the available data. The practical priority is therefore moderate-to-high in environments that load third-party or untrusted model weights, and lower where model provenance is tightly controlled; note the tension worth verifying with the vendor - the description labels the attacker 'unauthenticated' yet the vector is local, which typically implies the attacker already has some local foothold or control over model inputs.

An attacker crafts a malicious model weight file whose embedded pickle stream abuses the incomplete restrictions in TensorRT-LLM's unpickler, then gets it onto a target system - for example by publishing it as a seemingly legitimate model or by writing to a shared model directory a victim later loads. When the TensorRT-LLM process deserializes the weights during model initialization, the crafted payload executes, giving the local attacker code execution and potential privilege escalation. No public POC was identified in the provided data, and the Local attack vector with low complexity means exploitation is straightforward once the attacker controls the loaded artifact.