Tensorrt Llm
Monthly
Unbounded GPU resource allocation in NVIDIA TensorRT-LLM's OpenAI-compatible inference API allows an attacker to exhaust GPU resources on the host system, resulting in denial of service. Affected versions span all releases up to and including v1.3.0 rc14. No public exploit or active exploitation has been identified at time of analysis; SSVC classifies exploitation as none and technical impact as partial, consistent with a localized availability-only impact.
Denial of service in NVIDIA TensorRT-LLM (versions through v1.3.0 rc15) allows an attacker who can submit requests to the OpenAI-compatible inference API to trigger a reachable assertion in the sampler thread, crashing the inference service. The impact is limited strictly to availability - no confidentiality or integrity compromise is possible. No public exploit has been identified, EPSS sits at 0.12% (2nd percentile), and CISA SSVC rates exploitation status as none, placing this at low operational priority for most teams.
NVIDIA TensorRT-LLM versions through v1.3.0 rc14 exposes a gRPC server chat API endpoint susceptible to improper input validation (CWE-20), enabling a local attacker to crash the inference service and cause denial of service. The impact is strictly limited to availability - no code execution, confidentiality breach, or integrity compromise is possible. No public exploit code exists, EPSS sits at the 2nd percentile (0.12%), and CISA SSVC rates exploitation as 'none' with technical impact as 'partial', collectively indicating low urgency despite the moderate CVSS 6.2 score.
Improper control of code generation in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allows a locally authenticated, high-privileged attacker to influence the code generation pipeline under complex, interaction-dependent conditions, potentially leading to arbitrary code execution, data tampering, and information disclosure. Despite the high CIA impact ratings, the attack prerequisites - local access, high privileges, high complexity, and required user interaction - severely constrain real-world exploitability. No public exploit exists, EPSS sits at the 2nd percentile (0.12%), and CISA SSVC records exploitation status as none.
Missing authentication for a critical function in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allows a local attacker with high privileges to bypass internal authentication controls and trigger unauthorized execution of critical operations. Successful exploitation leads to code execution, data tampering, and information disclosure against the LLM inference runtime environment. No public exploit code has been identified and SSVC assessment confirms no known active exploitation, though the technical impact is rated total by CISA's decision framework.
Unsafe deserialization in NVIDIA TensorRT-LLM's visual gen server through version 1.3.0 rc11 allows a locally privileged attacker to submit malicious payloads over the zeroMQ channel and achieve arbitrary code execution. The vulnerability stems from the visual gen server accepting and deserializing zeroMQ messages without enforcing adequate authorization controls, exposing CWE-502 deserialization risks. No public exploit has been identified at time of analysis, EPSS rates exploitation probability at 0.22% (12th percentile), and SSVC confirms no known active exploitation - though technical impact is rated total given full C/I/A compromise potential.
Server-side request forgery in NVIDIA TensorRT-LLM for Linux exposes AI inference servers to internal network pivoting via the multimodal media fetching subsystem. Versions up to and including v1.3.0 rc16 are affected, allowing a network-accessible attacker to coerce the server into issuing arbitrary outbound HTTP requests to internal or external targets, leading to information disclosure and denial of service. No public exploit code exists and CISA has not listed this in the KEV catalog; EPSS probability sits at 0.11% (2nd percentile), indicating very low observed exploitation pressure at time of analysis.
Missing authentication in NVIDIA TensorRT-LLM for Linux lets an attacker reach the disaggregated orchestrator's FastAPI server directly and read, write, or delete internal cluster state, resulting in information disclosure, data tampering, and denial of service. The flaw (CWE-306) affects the orchestration layer that coordinates disaggregated prefill/decode inference workers. No public exploit identified at time of analysis, and the CVSS 3.1 base score is 7.3 with a local attack vector despite the request-based nature of the issue.
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (CWE-123), enabling arbitrary memory writes that can corrupt data, crash the inference service, or leak sensitive information. The flaw carries a CVSS 7.4 (High) score with a local attack vector and high attack complexity, and affects the TensorRT-LLM library used to build and serve optimized large-language-model inference on NVIDIA GPUs. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attacker corrupt heap memory by supplying a crafted serialized tensor, potentially causing information disclosure, data tampering, or denial of service. All platforms running affected TensorRT-LLM versions are impacted. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; NVIDIA rates exploitation as high-complexity (AC:H).
Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a host running the inference stack abuse its inter-process communication layer to trigger unsafe object deserialization (CWE-502), potentially yielding code execution, information disclosure, data tampering, and denial of service. The flaw is vendor-reported by NVIDIA and carries a CVSS 3.1 base of 7.8 (AV:L), meaning it is not remotely reachable but converts existing local access into full compromise of the model-serving process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Insecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the restricted unpickler that handles model-weight loading, potentially achieving code execution, privilege escalation, data tampering, and information disclosure. The flaw (CWE-502, CVSS 8.4) affects the GPU LLM-inference library and stems from the restricted unpickler failing to fully constrain what can be deserialized from an untrusted model artifact. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Unsafe deserialization in NVIDIA TensorRT-LLM's RPC testing component allows a local high-privileged attacker to trigger code execution, denial of service, data tampering, or information disclosure across a changed scope. The flaw is rated CVSS 7.5 despite local-only access and high attack complexity because successful exploitation crosses a security boundary (S:C) and yields full CIA impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Null pointer dereference in NVIDIA TensorRT-LLM across all supported platforms allows a local attacker to crash the application and cause denial of service. The flaw stems from an unchecked return value that is subsequently dereferenced, triggering a fault when the returned pointer is null. With a CVSS score of 5.5 and no public exploit or CISA KEV listing identified at time of analysis, real-world risk is moderate and constrained by the local attack vector and mandatory user interaction.
Deserialization of untrusted data in NVIDIA TensorRT-LLM across all platforms allows a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure by exploiting an unsafe serialized handle. The CVSS Changed Scope (S:C) indicates the impact can extend beyond the vulnerable component itself - notable given TensorRT-LLM's role as an inference serving library often integrated into multi-tenant or production AI infrastructure. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unsafe deserialization in NVIDIA TensorRT-LLM's MPI server component allows a high-privileged local attacker to achieve code execution, denial of service, data tampering, or information disclosure on systems running the affected library. The CVSS 7.5 score reflects high impact but constrained exploitability (AV:L/AC:H/PR:H), and no public exploit identified at time of analysis. Scope change (S:C) indicates compromise can extend beyond the vulnerable component to impact other resources on the host.
Unbounded GPU resource allocation in NVIDIA TensorRT-LLM's OpenAI-compatible inference API allows an attacker to exhaust GPU resources on the host system, resulting in denial of service. Affected versions span all releases up to and including v1.3.0 rc14. No public exploit or active exploitation has been identified at time of analysis; SSVC classifies exploitation as none and technical impact as partial, consistent with a localized availability-only impact.
Denial of service in NVIDIA TensorRT-LLM (versions through v1.3.0 rc15) allows an attacker who can submit requests to the OpenAI-compatible inference API to trigger a reachable assertion in the sampler thread, crashing the inference service. The impact is limited strictly to availability - no confidentiality or integrity compromise is possible. No public exploit has been identified, EPSS sits at 0.12% (2nd percentile), and CISA SSVC rates exploitation status as none, placing this at low operational priority for most teams.
NVIDIA TensorRT-LLM versions through v1.3.0 rc14 exposes a gRPC server chat API endpoint susceptible to improper input validation (CWE-20), enabling a local attacker to crash the inference service and cause denial of service. The impact is strictly limited to availability - no code execution, confidentiality breach, or integrity compromise is possible. No public exploit code exists, EPSS sits at the 2nd percentile (0.12%), and CISA SSVC rates exploitation as 'none' with technical impact as 'partial', collectively indicating low urgency despite the moderate CVSS 6.2 score.
Improper control of code generation in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allows a locally authenticated, high-privileged attacker to influence the code generation pipeline under complex, interaction-dependent conditions, potentially leading to arbitrary code execution, data tampering, and information disclosure. Despite the high CIA impact ratings, the attack prerequisites - local access, high privileges, high complexity, and required user interaction - severely constrain real-world exploitability. No public exploit exists, EPSS sits at the 2nd percentile (0.12%), and CISA SSVC records exploitation status as none.
Missing authentication for a critical function in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allows a local attacker with high privileges to bypass internal authentication controls and trigger unauthorized execution of critical operations. Successful exploitation leads to code execution, data tampering, and information disclosure against the LLM inference runtime environment. No public exploit code has been identified and SSVC assessment confirms no known active exploitation, though the technical impact is rated total by CISA's decision framework.
Unsafe deserialization in NVIDIA TensorRT-LLM's visual gen server through version 1.3.0 rc11 allows a locally privileged attacker to submit malicious payloads over the zeroMQ channel and achieve arbitrary code execution. The vulnerability stems from the visual gen server accepting and deserializing zeroMQ messages without enforcing adequate authorization controls, exposing CWE-502 deserialization risks. No public exploit has been identified at time of analysis, EPSS rates exploitation probability at 0.22% (12th percentile), and SSVC confirms no known active exploitation - though technical impact is rated total given full C/I/A compromise potential.
Server-side request forgery in NVIDIA TensorRT-LLM for Linux exposes AI inference servers to internal network pivoting via the multimodal media fetching subsystem. Versions up to and including v1.3.0 rc16 are affected, allowing a network-accessible attacker to coerce the server into issuing arbitrary outbound HTTP requests to internal or external targets, leading to information disclosure and denial of service. No public exploit code exists and CISA has not listed this in the KEV catalog; EPSS probability sits at 0.11% (2nd percentile), indicating very low observed exploitation pressure at time of analysis.
Missing authentication in NVIDIA TensorRT-LLM for Linux lets an attacker reach the disaggregated orchestrator's FastAPI server directly and read, write, or delete internal cluster state, resulting in information disclosure, data tampering, and denial of service. The flaw (CWE-306) affects the orchestration layer that coordinates disaggregated prefill/decode inference workers. No public exploit identified at time of analysis, and the CVSS 3.1 base score is 7.3 with a local attack vector despite the request-based nature of the issue.
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (CWE-123), enabling arbitrary memory writes that can corrupt data, crash the inference service, or leak sensitive information. The flaw carries a CVSS 7.4 (High) score with a local attack vector and high attack complexity, and affects the TensorRT-LLM library used to build and serve optimized large-language-model inference on NVIDIA GPUs. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attacker corrupt heap memory by supplying a crafted serialized tensor, potentially causing information disclosure, data tampering, or denial of service. All platforms running affected TensorRT-LLM versions are impacted. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; NVIDIA rates exploitation as high-complexity (AC:H).
Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a host running the inference stack abuse its inter-process communication layer to trigger unsafe object deserialization (CWE-502), potentially yielding code execution, information disclosure, data tampering, and denial of service. The flaw is vendor-reported by NVIDIA and carries a CVSS 3.1 base of 7.8 (AV:L), meaning it is not remotely reachable but converts existing local access into full compromise of the model-serving process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Insecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the restricted unpickler that handles model-weight loading, potentially achieving code execution, privilege escalation, data tampering, and information disclosure. The flaw (CWE-502, CVSS 8.4) affects the GPU LLM-inference library and stems from the restricted unpickler failing to fully constrain what can be deserialized from an untrusted model artifact. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Unsafe deserialization in NVIDIA TensorRT-LLM's RPC testing component allows a local high-privileged attacker to trigger code execution, denial of service, data tampering, or information disclosure across a changed scope. The flaw is rated CVSS 7.5 despite local-only access and high attack complexity because successful exploitation crosses a security boundary (S:C) and yields full CIA impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Null pointer dereference in NVIDIA TensorRT-LLM across all supported platforms allows a local attacker to crash the application and cause denial of service. The flaw stems from an unchecked return value that is subsequently dereferenced, triggering a fault when the returned pointer is null. With a CVSS score of 5.5 and no public exploit or CISA KEV listing identified at time of analysis, real-world risk is moderate and constrained by the local attack vector and mandatory user interaction.
Deserialization of untrusted data in NVIDIA TensorRT-LLM across all platforms allows a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure by exploiting an unsafe serialized handle. The CVSS Changed Scope (S:C) indicates the impact can extend beyond the vulnerable component itself - notable given TensorRT-LLM's role as an inference serving library often integrated into multi-tenant or production AI infrastructure. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unsafe deserialization in NVIDIA TensorRT-LLM's MPI server component allows a high-privileged local attacker to achieve code execution, denial of service, data tampering, or information disclosure on systems running the affected library. The CVSS 7.5 score reflects high impact but constrained exploitability (AV:L/AC:H/PR:H), and no public exploit identified at time of analysis. Scope change (S:C) indicates compromise can extend beyond the vulnerable component to impact other resources on the host.