Threat Intelligence Database

NVIDIA TensorRT-LLM has a vulnerability in its OpenAI-compatible inference API that allows an attacker to cause allocation of GPU resources without any limits or throttling. This can lead to denial of service conditions. The vulnerability is identified as CWE-770 and has a CVSS score of 6.2, indicating medium severity. No official patch or remediation guidance has been provided yet.

CVE-2026-47475 is a medium severity vulnerability in NVIDIA TensorRT-LLM's OpenAI-compatible inference API. It involves a reachable assertion in the sampler thread that an attacker could trigger. Successful exploitation may cause a denial of service condition. No patch or official remediation guidance is currently provided by the vendor. The affected version is 0.0. No known exploits are reported in the wild.

NVIDIA TensorRT-LLM contains an improper input validation vulnerability in its gRPC server chat API endpoint. This flaw can be exploited locally to cause a denial of service condition. The vulnerability is identified as CWE-20 and affects version 0.0 of the product. No official patch or remediation guidance has been provided yet. The issue has a medium severity rating with a CVSS score of 6.2.

NVIDIA TensorRT-LLM for Linux has a vulnerability (CVE-2026-24226) involving improper control of code generation due to inclusion of functionality from an untrusted control sphere. Exploitation could lead to code execution, data tampering, and information disclosure. The vulnerability has a medium severity with a CVSS score of 6.3. No patch or official remediation guidance is currently available.

NVIDIA TensorRT-LLM contains a deserialization vulnerability in its visual gen server component. This vulnerability arises from unsafe deserialization of unauthorized zeroMQ data, potentially allowing an attacker to execute arbitrary code. The issue affects version 0.0 of TensorRT-LLM. The CVSS score is 6.4, indicating a medium severity level.

NVIDIA TensorRT-LLM for Linux contains a vulnerability in its disaggregated orchestrator component. This flaw allows an attacker to read, write, or delete internal cluster state by sending requests to the FastAPI server without authentication. Exploiting this vulnerability could lead to information disclosure, data tampering, and denial of service. The vulnerability is identified as CWE-306 (Missing Authentication for Critical Function). The CVSS v3.1 base score is 7.3, indicating a high severity level. No patch or official remediation has been confirmed yet.

NVIDIA TensorRT-LLM contains a write-what-where vulnerability (CWE-123) that could allow an attacker to perform arbitrary memory writes. Exploitation may result in data tampering, denial of service, and information disclosure. The vulnerability has a high severity score of 7.4. No official patch or remediation guidance is currently available from the vendor.

NVIDIA TensorRT-LLM contains a heap-based buffer overflow vulnerability in its tensor deserialization functionality. Exploitation of this flaw could allow an attacker to cause information disclosure, data tampering, or denial of service. The vulnerability is identified as CVE-2026-47471 and has a high severity rating with a CVSS score of 7.5. No official patch or remediation guidance is currently available from the vendor.

NVIDIA TensorRT-LLM has a deserialization vulnerability in its inter-process communication layer that can be exploited by a local attacker with the same user privileges. Successful exploitation could result in code execution, information disclosure, data tampering, and denial of service. The vulnerability is identified as CWE-502 and carries a high severity rating with a CVSS score of 7.8. No patch or official remediation guidance is currently available.

NVIDIA TensorRT-LLM for Linux has a deserialization vulnerability in its restricted unpickler used for model weight deserialization. This flaw allows a local, unauthenticated attacker to deserialize untrusted data, potentially leading to code execution, privilege escalation, data tampering, and information disclosure. The vulnerability is identified as CVE-2026-24233 with a high severity rating and a CVSS score of 8.4. No official patch or remediation guidance has been provided yet by the vendor.