Threat Intelligence Database

NVIDIA TensorRT-LLM version 0.0 contains a reachable assertion vulnerability in its OpenAI-compatible inference API. This vulnerability allows an attacker to trigger an assertion failure in the sampler thread, potentially causing a denial of service. The vulnerability does not impact confidentiality or integrity but affects availability. No official patch or remediation guidance is currently available from the vendor.

NVIDIA TensorRT-LLM version 0.0 contains a write-what-where vulnerability (CWE-123) that could allow an attacker to manipulate memory. Exploitation may result in data tampering, denial of service, and information disclosure. The vulnerability has a high severity with a CVSS score of 7.4. No patch or official remediation is currently available. The product is not a cloud service, so remediation depends on vendor updates. There are no known exploits in the wild at this time.

NVIDIA TensorRT-LLM has a deserialization vulnerability in its inter-process communication layer that can be exploited by a local attacker with the same user privileges. Exploiting this flaw could allow code execution, information disclosure, data tampering, and denial of service. The vulnerability is identified as CWE-502 and carries a high severity score of 7.8. The affected version is 0.0. No official patch or remediation guidance is currently available.

NVIDIA TensorRT-LLM contains a heap-based buffer overflow vulnerability in its tensor deserialization functionality. Exploitation of this flaw could allow an attacker to cause information disclosure, data tampering, or denial of service. The vulnerability affects version 0.0 of TensorRT-LLM. No official patch or remediation guidance has been provided yet.

CVE-2026-47470 is a medium severity vulnerability in NVIDIA TensorRT-LLM affecting version 0.0. It involves improper input validation (CWE-20) in the gRPC server chat API endpoint, which can be exploited locally to cause a denial of service. No confidentiality or integrity impact is reported. No patch or official remediation has been confirmed yet.

NVIDIA TensorRT-LLM has a vulnerability in its OpenAI-compatible inference API that allows an attacker to cause allocation of GPU resources without any limits or throttling. This can lead to denial of service conditions. The vulnerability is identified as CWE-770 and affects version 0.0 of the product. The CVSS score is 6.2, indicating a medium severity level. No patch or official remediation has been announced yet.

NVIDIA TensorRT-LLM for Linux has a deserialization vulnerability in its restricted unpickler used for model weight deserialization. A local, unauthenticated attacker could exploit this to deserialize untrusted data, potentially leading to code execution, privilege escalation, data tampering, and information disclosure. The vulnerability is tracked as CVE-2026-24233 with a high severity score of 8.4. No official patch or remediation guidance is currently available from the vendor. The affected version is 0.0.

NVIDIA TensorRT-LLM for Linux has a vulnerability in its disaggregated orchestrator component due to missing authentication on critical functions. An attacker can send requests to the FastAPI server to read, write, or delete internal cluster state. This can lead to information disclosure, data tampering, and denial of service. The vulnerability affects version 0.0 of TensorRT-LLM. No patch or official remediation has been indicated yet. The CVSS score is 7.3, indicating a high severity risk.

NVIDIA TensorRT-LLM for Linux has a vulnerability (CVE-2026-24226) involving improper control of code generation due to inclusion of functionality from an untrusted control sphere. Exploitation could lead to code execution, data tampering, and information disclosure. The vulnerability has a CVSS score of 6.3 (medium severity). No patch or official remediation guidance is currently available.

NVIDIA TensorRT-LLM contains a deserialization vulnerability in its visual gen server component. This vulnerability involves unsafe deserialization of unauthorized zeroMQ data, which could allow an attacker with high privileges to execute arbitrary code. The issue affects version 0.0 of TensorRT-LLM. The CVSS score is 6.4, indicating a medium severity level.