EUVD-2026-44449
GHSA-g2v9-2grm-8qxj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local same-user foothold on host
-
DeliveryLocate TensorRT-LLM IPC channel
-
ExploitInject crafted serialized payload
-
ExecutionTrigger unsafe deserialization (CWE-502)
-
PersistExecute code in inference process
-
ImpactExfiltrate/tamper model data or crash service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have local, same-user access on the host running TensorRT-LLM and the ability to interact with (write to/inject into) its inter-process communication channel - the CVSS metrics AV:L/PR:L/UI:N confirm local access with low privileges and no user interaction. The specific enabling condition is that the IPC layer deserializes untrusted data (CWE-502), so a deployment is exposed whenever multiple processes/workers exchange serialized objects over that channel. Limiting factors that reduce real-world risk: there is no network attack surface (AV:L, not remote), the attacker must first obtain code execution or an account as the same user the service runs as, and single-tenant or well-isolated deployments where no untrusted process shares that UID are effectively out of reach. This is therefore a local escalation/lateral-execution condition, not a default-configuration remote exposure. |
| Impact | The signals are internally consistent for a serious-but-locally-scoped issue: the CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H gives 7.8 (High) driven by full C/I/A impact, but attack vector is Local and requires low privileges (PR:L), i.e. a same-user foothold as the description states. This is a privilege/trust-boundary escalation within a host, not an internet-facing RCE, so it should not be triaged like a remote unauthenticated bug despite the high base score. No EPSS score was provided in the input, and the CVE is not in CISA KEV, and no POC is referenced - so there is no evidence of active or automatable mass exploitation. The description ('local same-user access') aligns cleanly with the CVSS Local/PR:L metrics, so there is no vector-versus-description conflict to flag; the main missing data points are EPSS probability, a confirmed fixed version, and any independent exploit maturity signal. |
| Exploit ScenarioDerived | An attacker who has already gained a foothold as the same OS user that runs the TensorRT-LLM inference service (for example via a compromised co-located application or a shared-account CI/inference host) writes a crafted serialized payload into the runtime's IPC channel. When the TensorRT-LLM process deserializes that data, the malicious object is instantiated and executes attacker code in the context of the model-serving process, giving full read/write access to model data and the ability to crash the service. No public POC is referenced, but the low attack complexity (AC:L) means exploitation is straightforward once same-user access is obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a host running the inference stack abuse its inter-process communication layer to trigger unsafe object deserialization (CWE-502), potentially yielding code execution, information disclosure, data tampering, and denial of service. The flaw is vendor-reported by NVIDIA and carries a CVSS 3.1 base of 7.8 (AV:L), meaning it is not remotely reachable but converts existing local access into full compromise of the model-serving process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
No vendor-released patch version was identified in the provided data, so the primary action is to monitor NVIDIA's security bulletin channel (typically https://nvidia.custhelp.com / the NVIDIA Product Security page) referenced from the CVE and upgrade TensorRT-LLM to the fixed release as soon as NVIDIA publishes it, then track the CVE via https://nvd.nist.gov/vuln/detail/CVE-2026-47472. Because exploitation requires same-user local access, effective compensating controls focus on tightening the local trust boundary: run TensorRT-LLM under a dedicated low-privilege service account isolated from other users and workloads (limits blast radius but requires deployment changes), restrict filesystem permissions and directory ownership on any IPC sockets, named pipes, or shared-memory/temp paths so only the intended process user can access them, and isolate the inference runtime in a hardened container or namespace to prevent co-tenant processes from reaching the IPC channel (adds operational overhead and may complicate multi-worker GPU setups). Avoid running the runtime on multi-tenant hosts where untrusted users share the same UID, and verify exact fix versions from NVIDIA before deploying rather than assuming any version string.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TensorRT-LLM is NVIDIA's open-source library for optimizing and serving large language models on GPUs, commonly deployed as a Python/C++ inference runtime that uses inter-process communication (IPC) to coordinate worker processes (for example across tensor/pipeline-parallel GPU workers). The root cause is CWE-502, Deserialization of Untrusted Data: the IPC channel deserializes objects (typically via Python pickle or a similar mechanism used to pass tensors/commands between processes) without validating that the serialized payload is trustworthy. When an attacker running as the same local user can write to or inject into that IPC channel, crafted serialized data is reconstructed into live objects, allowing attacker-controlled code paths to execute. The CPE cpe:2.3:a:nvidia:tensorrt-llm:*:*:*:*:*:*:*:* indicates all versions are in scope pending a fixed release identifier.
Know when Tensorrt Llm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description's 'local same-user access' maps to AV:L and PR:L; unsafe deserialization plausibly yields full code execution, so C/I/A all High and AC:L.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
DescriptionCVE.org
NVIDIA TensorRT-LLM contains a vulnerability in its inter-process communication layer where an attacker with local same-user access could cause deserialization. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.
Articles & Coverage 1
Executive ViewAI
NVIDIA TensorRT-LLM contains a local privilege escalation vulnerability (CVE-2026-47472) in its inter-process communication layer that allows attackers with existing local system access to compromise model-serving processes and potentially exfiltrate or manipulate inference data. Organizations operating LLM inference infrastructure should inventory affected deployments and implement immediate access controls, as no vendor patch is currently available.
Restrict local user access to systems running TensorRT-LLM; disable unused inter-process communication features where operationally feasible; deploy containers or virtual machines with minimal privileges and reduced attack surface; implement endpoint detection and response (EDR) to monitor for exploitation of deserialization code paths; segment inference infrastructure from general-purpose computing and development environments; require multi-factor authentication and audit logging for administrative access to inference servers; monitor NVIDIA security bulletins for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Tensorrt Llm
View allDeserialization of untrusted data in NVIDIA TensorRT-LLM across all platforms allows a local, low-privileged attacker to
Unsafe deserialization in NVIDIA TensorRT-LLM's RPC testing component allows a local high-privileged attacker to trigger
Unsafe deserialization in NVIDIA TensorRT-LLM's MPI server component allows a high-privileged local attacker to achieve
Insecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the
TensorRT-LLM 1.3.0rc24 can load a tokenizer from an attacker-influenced location during KvCacheAwareRouter initializatio
Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attack
Null pointer dereference in NVIDIA TensorRT-LLM across all supported platforms allows a local attacker to crash the appl
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (C
Missing authentication in NVIDIA TensorRT-LLM for Linux lets an attacker reach the disaggregated orchestrator's FastAPI
Server-side request forgery (SSRF) in NVIDIA TensorRT-LLM 1.3.0rc24 allows an attacker who can reach a local input vecto
Server-side request forgery (CWE-918) in NVIDIA TensorRT-LLM, reported by NVIDIA at CVSS 7.1, allows an attacker positio
Server-side request forgery in NVIDIA TensorRT-LLM for Linux exposes AI inference servers to internal network pivoting v
Exploit-DB