EUVD-2026-44489
GHSA-jp25-r59g-9p63
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious TensorRT model/engine file
-
DeliveryDeliver to victim via model repo or file
-
ExploitVictim loads file into TensorRT
-
ExecutionOverflow heap buffer during parsing
-
ImpactExecute code in inference process context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a local user to load or process attacker-supplied content with a TensorRT-based application - the UI:R metric confirms victim interaction is mandatory, and AV:L confirms the attacker cannot trigger this over the network. The concrete prerequisite is that TensorRT parses or deserializes an untrusted model/engine input containing a crafted oversized field that overflows a heap buffer. Limiting factors: the attacker needs no prior privileges (PR:N) but must induce a user to open malicious content, and the scope is unchanged (S:U), so impact is confined to the process running TensorRT. This is not remotely exploitable against a default network-exposed service. |
| Impact | The CVSS 3.1 base score is 7.8 (High), driven by high impact across all three dimensions but constrained by a local attack vector (AV:L) and required user interaction (UI:R) - meaning a victim must load or process attacker-supplied content, not a remotely reachable network service. No EPSS score was provided in the input, so exploitation probability cannot be quantified here; the vulnerability is not in CISA KEV and no POC was referenced, so the current signals point to a real but not urgently-exploited issue. The combination PR:N with AV:L/UI:R is internally consistent: no pre-existing privileges are needed, but the attacker relies on a user action (opening a crafted model/engine file) to gain local execution. This is a priority for environments that ingest untrusted models, but the local-plus-interaction requirement meaningfully lowers real-world risk versus a network-facing RCE of the same score. |
| Exploit ScenarioDerived | An attacker crafts a malicious model or serialized engine file with manipulated size/length fields and delivers it to a victim (e.g., via a shared model repository, email, or a compromised model-hub entry). When the victim loads the file into a TensorRT-based application, the parser overflows a heap buffer, corrupting memory and allowing the attacker to execute code in the context of the inference process. No public POC was referenced, and the AV:L/AC:L/UI:R vector means the attack is low-complexity but hinges on the victim opening the crafted content. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Code execution in NVIDIA TensorRT is possible when the SDK processes a maliciously crafted input that overflows a heap-based buffer (CWE-122), corrupting adjacent heap memory. The flaw affects the TensorRT deep-learning inference library and requires a local user to load attacker-supplied content, per the AV:L/UI:R CVSS vector; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Successful exploitation yields full loss of confidentiality, integrity, and availability (C:H/I:H/A:H) in the context of the process running the inference job.
RemediationAI
Consult NVIDIA's advisory (a_id/5855) at https://nvidia.custhelp.com/app/answers/detail/a_id/5855 and upgrade TensorRT to the fixed release identified there; an exact fixed version is not present in the provided input, so treat the advisory as authoritative rather than assuming a version number. Because exploitation requires processing attacker-supplied content, the most effective compensating control is to only load models and serialized engine files from trusted, integrity-verified sources - validate provenance and checksums before deserialization, and avoid deserializing engines received from untrusted parties (deserialization of untrusted TensorRT engines is inherently risky). Where feasible, run inference workloads in a sandboxed or least-privilege container so heap corruption is contained to a low-privilege context, accepting the trade-off of added deployment complexity and marginal performance overhead. Patch status: Patch available per vendor advisory; released fixed version not independently confirmed from the provided data.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TensorRT is NVIDIA's high-performance deep-learning inference optimizer and runtime SDK, used to build and execute optimized inference 'engines' from model formats such as ONNX. The affected CPE cpe:2.3:a:nvidia:tensorrt:*:*:*:*:*:*:*:* indicates the application/library itself rather than a specific driver or firmware component. The root cause is classified as CWE-122 (Heap-Based Buffer Overflow): during parsing or deserialization of model/engine data, the library writes past the bounds of a heap-allocated buffer - typically the result of trusting an attacker-controllable size or length field without adequate bounds validation - allowing controlled heap corruption that can be steered toward arbitrary code execution.
Know when Tensorrt gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-parsing flaw needing no privileges but victim interaction (AV:L/PR:N/UI:R); crafted-input heap overflow yields full code execution, so C/I/A all High.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
DescriptionCVE.org
NVIDIA TensorRT contains a vulnerability where an attacker might cause an overflow to a heap-based buffer. A successful exploit of this vulnerability might lead to code execution.
Articles & Coverage 1
Zero Day Initiative Advisories
Executive ViewAI
NVIDIA TensorRT contains a heap-based buffer overflow vulnerability (CVE-2026-24272) that enables arbitrary code execution with full system compromise within inference processes. Organizations deploying TensorRT for production AI/ML workloads face risk of intellectual property theft, service disruption, and data manipulation through locally-supplied malicious models or inputs. No vendor-released patch has been identified at time of analysis.
Restrict local user access to TensorRT processes and model storage directories; execute inference workloads in isolated containers or virtual machines with minimal privilege levels; implement strict model and input source verification procedures; enable process execution monitoring for anomalous behavior; limit model loading to pre-approved, scanned sources only.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Local code execution in NVIDIA TensorRT is possible when the library parses an attacker-supplied input (such as a crafte
Improper array index validation (CWE-129) in NVIDIA TensorRT allows an attacker to trigger out-of-bounds memory access t
Out-of-bounds write in NVIDIA TensorRT prior to version 10.16.1 allows an attacker to corrupt memory and tamper with dat
Code execution in NVIDIA TensorRT (all versions through v10.16.1) arises from unsafe deserialization of untrusted data (
Exploit-DB