CVE-2026-24233: NVIDIA TensorRT-LLM RCE Vulnerability

CVE-2026-24233 Overview

CVE-2026-24233 affects NVIDIA TensorRT-LLM for Linux. The vulnerability resides in the restricted unpickler used for model weight deserialization. A local, unauthenticated attacker can trigger deserialization of untrusted data by supplying a crafted model file. Successful exploitation may lead to code execution, privilege escalation, data tampering, and information disclosure.

The flaw is classified under CWE-502: Deserialization of Untrusted Data. Because TensorRT-LLM is widely deployed for large language model (LLM) inference on GPU infrastructure, malicious model artifacts distributed through public model hubs or shared storage create a realistic exploitation path.

Critical Impact
A crafted TensorRT-LLM model file can bypass the restricted unpickler and execute arbitrary code in the context of the process loading the model, compromising confidentiality, integrity, and availability of the host.

Affected Products

NVIDIA TensorRT-LLM for Linux
Deployments loading third-party or user-supplied model weights
GPU inference hosts running unpatched TensorRT-LLM versions

Discovery Timeline

2026-07-14 - CVE-2026-24233 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-24233

Vulnerability Analysis

TensorRT-LLM loads model weights that are serialized using Python's pickle format. To limit exposure, the project implements a restricted unpickler that is intended to whitelist only safe classes and callables during deserialization. The vulnerability shows that this restriction is insufficient. An attacker can construct a pickle stream referencing objects the unpickler still resolves, and reach code paths that execute attacker-controlled logic during object reconstruction.

Because deserialization happens before any inference occurs, exploitation triggers as soon as a poisoned model artifact is loaded. The attack executes with the privileges of the loader process, which on inference servers is often a service account with GPU access and network reachability.

Root Cause

The root cause is an incomplete allowlist in the restricted unpickler. Python's pickle protocol supports opcodes such as GLOBAL, REDUCE, and BUILD that instantiate objects and invoke callables. When the whitelist logic fails to block callables with side effects, or accepts classes whose __reduce__ or __setstate__ methods perform sensitive operations, the sandbox is bypassed.

Attack Vector

The attack vector is local. An attacker must place a malicious serialized model in a location the victim process reads, such as a shared model cache, a mounted volume, a downloaded checkpoint, or a model hub artifact. When TensorRT-LLM deserializes the file, the crafted pickle payload executes attacker code without any user interaction or authentication.

Exploitation does not require memory corruption primitives or timing dependencies. The vulnerability follows the standard Python insecure deserialization pattern documented in CWE-502. No public proof-of-concept exploit code is available at the time of publication. See the NVD CVE-2026-24233 Details and the CVE.org Entry for CVE-2026-24233 for authoritative references.

Detection Methods for CVE-2026-24233

Indicators of Compromise

Unexpected child processes spawned by TensorRT-LLM inference workers or Python runtimes loading model files.
Outbound network connections from GPU inference hosts to previously unseen destinations following a model load event.
Model files (.pkl, .bin, .pt, or custom checkpoint formats) sourced from untrusted locations or introduced outside of change control.
Modifications to model cache directories or new files appearing in shared model stores without a corresponding deployment event.

Detection Strategies

Monitor process lineage where a Python or TensorRT-LLM process becomes the parent of shells, package managers, or network utilities.
Alert on file reads of pickle-formatted model artifacts followed within seconds by process execution or credential access activity.
Inspect model artifacts statically for pickle opcodes such as GLOBAL and REDUCE that reference os, subprocess, builtins, or other high-risk modules.

Monitoring Recommendations

Enable Linux audit rules on directories containing model weights to capture create, modify, and read events.
Log outbound egress from inference nodes and baseline expected destinations for model downloads and telemetry.
Centralize inference host telemetry in a security data lake and correlate model-load events with process and network activity.

How to Mitigate CVE-2026-24233

Immediate Actions Required

Restrict model loading to artifacts from trusted, integrity-verified sources only, and block ad hoc downloads from public hubs.
Enforce cryptographic signature or hash verification on all model files before they are passed to TensorRT-LLM.
Run inference workloads under least-privilege service accounts with no interactive shell and limited filesystem and network access.
Isolate GPU inference hosts on dedicated network segments to constrain lateral movement if code execution occurs.

Patch Information

Apply the NVIDIA-supplied TensorRT-LLM update that addresses CVE-2026-24233. Refer to the NVD CVE-2026-24233 Details and the CVE.org Entry for CVE-2026-24233 for the current fixed versions and vendor security bulletin links as they become available.

Workarounds

Prefer safe serialization formats such as safetensors over pickle-based checkpoints for LLM weights where supported.
Load untrusted models inside sandboxed containers with seccomp, AppArmor, or SELinux policies that deny process execution and outbound networking.
Perform offline scanning of pickle files with tools that enumerate dangerous opcodes before deploying models to production inference hosts.

bash

# Configuration example: audit and restrict model directory access
sudo auditctl -w /opt/models -p rwa -k tensorrt_model_access
sudo chown -R tensorrt-svc:tensorrt-svc /opt/models
sudo chmod -R 550 /opt/models

# Verify checkpoint integrity before loading
sha256sum -c /opt/models/checksums.sha256 || exit 1