CVE-2026-24220

Analyzed Analyzed - Analysis Complete

Unsafe Deserialization in NVIDIA TensorRT-LLM

Publication date: 2026-07-14

Last updated on: 2026-09-22

Assigner: NVIDIA Corporation

Description

NVIDIA TensorRT-LLM for any platform contains a vulnerability in visual gen server, where an attacker could cause an unsafe deserialization by unauthorized zeroMQ deserialization. A successful exploit of this vulnerability might lead to code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-09-22

Generated

2026-10-03

AI Q&A

2026-07-15

EPSS Evaluated

2026-10-02

NVD

CVE-2026-24220

Affected Vendors & Products

Vendor	Product	Version / Range
nvidia	tensorrt-llm	to 1.3.0 (inc)
nvidia	tensorrt-llm	1.3.0
nvidia	tensorrt-llm	1.3.0
nvidia	tensorrt-llm	1.3.0
nvidia	tensorrt-llm	1.3.0
nvidia	tensorrt-llm	1.3.0
nvidia	tensorrt-llm	1.3.0
nvidia	tensorrt-llm	1.3.0
nvidia	tensorrt-llm	1.3.0
nvidia	tensorrt-llm	1.3.0
nvidia	tensorrt-llm	1.3.0
nvidia	tensorrt-llm	1.3.0
nvidia	tensorrt-llm	1.3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability in NVIDIA TensorRT-LLM allows an attacker to execute unsafe deserialization via unauthorized zeroMQ deserialization in the visual gen server. This could lead to code execution if exploited successfully.

Detection Guidance

Detection requires checking for unauthorized zeroMQ deserialization in NVIDIA TensorRT-LLM's visual gen server. Monitor network traffic for unexpected zeroMQ connections or deserialization attempts. Check logs for unusual code execution patterns or unauthorized processes linked to TensorRT-LLM.

Impact Analysis

An attacker could exploit this to run malicious code on your system, potentially gaining unauthorized access or control over affected applications using TensorRT-LLM.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially compromising data confidentiality and integrity. This may violate compliance requirements for GDPR, HIPAA, and other regulations that mandate strict access controls and data protection.

Mitigation Strategies

Immediately disable the visual gen server component in NVIDIA TensorRT-LLM if not required. Apply patches or updates from NVIDIA as soon as they are available. Restrict network access to zeroMQ ports used by TensorRT-LLM to trusted sources only.

Hi! I’m here to help you understand CVE-2026-24220. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70