NVIDIA TensorRT-LLM contains a CWE-502 deserialization vulnerability in its MPI server. Unsafe deserialization of untrusted input could be exploited by an attacker with high privileges and local access to execute arbitrary code, disrupt service, alter data, or disclose sensitive information. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability, but requiring local privileged access and high attack complexity. No patch or official remediation level has been disclosed by the vendor as of the publication date.

Successful exploitation can lead to remote code execution, denial of service, data tampering, and information disclosure within the affected NVIDIA TensorRT-LLM environment. The attack requires local access with high privileges and has high attack complexity, limiting the ease of exploitation. Confidentiality, integrity, and availability impacts are all rated high according to the CVSS vector.

Patch status is not yet confirmed — check the NVIDIA advisory for current remediation guidance. Until an official fix is released, restrict local access to the MPI server component of TensorRT-LLM to trusted users only and monitor for suspicious activity. Avoid processing untrusted data through the MPI server where possible.