CVE-2026-24220 is a CWE-502 vulnerability in NVIDIA TensorRT-LLM's visual gen server, where unsafe deserialization of untrusted zeroMQ data can occur. An attacker with high privileges could exploit this vulnerability to execute arbitrary code on the affected system. The vulnerability affects version 0.0 of TensorRT-LLM. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Successful exploitation could lead to high impact on confidentiality, integrity, and availability due to arbitrary code execution. However, exploitation requires high privileges and no user interaction, limiting the attack vector. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the visual gen server component and ensure that only trusted users with appropriate privileges can interact with zeroMQ deserialization processes.