CVE-2026-24227: Nvidia TensorRT RCE Vulnerability

CVE-2026-24227 Overview

CVE-2026-24227 is a deserialization of untrusted data vulnerability [CWE-502] affecting NVIDIA TensorRT. TensorRT is a high-performance deep learning inference library used to optimize and deploy neural networks on NVIDIA GPUs. The flaw allows an attacker to supply crafted serialized data that TensorRT processes without adequate validation. Successful exploitation can result in arbitrary code execution within the context of the process loading the malicious data.

NVIDIA published a security advisory documenting the issue and released fixed versions. The vulnerability was added to the National Vulnerability Database on 2026-07-14 and last updated on 2026-07-17.

Critical Impact
An attacker can achieve remote code execution by supplying a malicious serialized TensorRT engine or plan file, compromising confidentiality, integrity, and availability of the affected system.

Affected Products

NVIDIA TensorRT (all versions prior to the fixed release referenced in the NVIDIA advisory)
Applications and inference pipelines that load third-party TensorRT engine or plan files
GPU-accelerated ML workloads on Windows and Linux hosts using TensorRT

Discovery Timeline

2026-07-14 - CVE-2026-24227 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-24227

Vulnerability Analysis

The vulnerability originates in how TensorRT deserializes input data, tracked under [CWE-502] Deserialization of Untrusted Data. TensorRT accepts serialized engine files (commonly called plan files) that describe optimized inference graphs. When the runtime reconstructs these graphs, it trusts the structure and metadata contained in the file.

An attacker who can influence the plan file loaded by a target application can embed data that triggers unsafe object construction during deserialization. This condition can be reached remotely because the attack vector is network-based, requires no privileges, and needs no user interaction. Exploitation results in code execution in the process hosting TensorRT, which typically runs with elevated access to GPU resources and sometimes to model weights, telemetry, or sensitive data.

Root Cause

The root cause is insufficient validation of untrusted serialized input before object reconstruction. TensorRT plan files were designed for a trusted deployment pipeline where the producer and consumer are the same party. When an application accepts plan files from external or user-controlled sources, the deserializer processes attacker-controlled fields that can direct execution flow during graph reconstruction.

Attack Vector

Exploitation typically follows one of these paths:

An inference service accepts model uploads from users and loads them via IRuntime::deserializeCudaEngine().
A pipeline downloads plan files from a shared registry or object store that an attacker can write to.
A developer environment loads a plan file sourced from a public repository or model hub.

A specific proof-of-concept for CVE-2026-24227 has not been published. Refer to the NVIDIA Support Advisory for authoritative technical details and the NVD CVE-2026-24227 Detail record for scoring metadata.

Detection Methods for CVE-2026-24227

Indicators of Compromise

Unexpected child processes spawned by applications hosting TensorRT (trtexec, Triton Inference Server, custom inference services).
Plan or engine files (.plan, .engine, .trt) loaded from writable, user-facing, or network-mounted directories.
Outbound network connections from GPU inference hosts to unknown destinations shortly after model load events.
Modifications to model registries or object storage buckets by non-pipeline identities.

Detection Strategies

Inventory all services calling TensorRT deserialization APIs and flag those consuming externally sourced plan files.
Alert on writes to model directories from accounts outside the CI/CD pipeline.
Monitor GPU inference processes for anomalous behavior such as shell execution, file system enumeration, or credential access.
Correlate inference service telemetry with EDR process lineage to identify post-load exploitation activity.

Monitoring Recommendations

Enable file integrity monitoring on directories containing TensorRT engine files.
Log all model load operations with source path, hash, and requesting identity.
Aggregate GPU host logs into a centralized SIEM and retain them for post-incident review.
Baseline normal inference process behavior and alert on deviations such as new outbound connections or spawned interpreters.

How to Mitigate CVE-2026-24227

Immediate Actions Required

Apply the fixed TensorRT release referenced in the NVIDIA Support Advisory.
Audit all inference services and remove any code paths that load plan files from untrusted sources.
Rebuild engine files from trusted ONNX or framework-native models rather than accepting prebuilt plans.
Rotate credentials and inspect activity on any host that loaded plan files from an untrusted origin.

Patch Information

NVIDIA has released updated TensorRT packages that address the deserialization flaw. Consult the NVIDIA Support Advisory for the specific fixed version numbers applicable to your platform and TensorRT major release. Update development environments, container images, and production inference nodes to the patched version.

Workarounds

Restrict plan file sources to a trusted, signed model registry with cryptographic verification before loading.
Run inference workloads in isolated containers or sandboxes with minimal privileges and no outbound network access.
Enforce mandatory code review and provenance checks on any model artifact promoted to production.
Disable user-facing endpoints that accept arbitrary engine file uploads until the patch is deployed.

bash

# Verify installed TensorRT version on Linux hosts
dpkg -l | grep -i tensorrt

# Or query via Python
python3 -c "import tensorrt as trt; print(trt.__version__)"

# Restrict engine file directory permissions to pipeline service account
chown -R inference-svc:inference-svc /opt/models/engines
chmod -R 550 /opt/models/engines