NVIDIA TensorRT-LLM contains a CWE-502 deserialization of untrusted data vulnerability in its RPC testing functionality. This flaw allows an attacker with local high privileges to exploit unsafe deserialization, potentially leading to code execution, denial of service, data tampering, and information disclosure. The CVSS 3.1 base score is 7.5, reflecting high impact but requiring local access and elevated privileges. No patch or official remediation level has been disclosed as of the published date.

Successful exploitation could result in complete compromise of the affected system's confidentiality, integrity, and availability due to arbitrary code execution, denial of service, data tampering, and information disclosure. However, exploitation requires local access with high privileges and has high attack complexity.

Patch status is not yet confirmed — check the NVIDIA vendor advisory for current remediation guidance. Until a fix is available, limit access to systems running TensorRT-LLM to trusted users with appropriate privileges and monitor for suspicious activity related to RPC testing components.