NVIDIA TensorRT-LLM contains a CWE-502 deserialization of untrusted data vulnerability. The unsafe deserialization of serialized handles can lead to code execution, data tampering, and information disclosure. The vulnerability requires local access with low privileges and does not require user interaction. The CVSS 3.1 base score is 6.3, reflecting medium severity with impacts on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by NVIDIA. This vulnerability affects all versions of TensorRT-LLM.

Successful exploitation could allow an attacker with local low-privilege access to execute arbitrary code, modify data, or access sensitive information within the affected system. This impacts confidentiality, integrity, and availability of the system running TensorRT-LLM. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the NVIDIA vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users only and monitor for updates from NVIDIA. No official mitigation or temporary fix has been provided.