CVE-2026-24238 Overview
CVE-2026-24238 affects NVIDIA TensorRT, a high-performance deep learning inference library used across AI and machine learning workloads. The vulnerability stems from improper validation of an array index [CWE-129]. A local attacker with the ability to supply crafted input to a TensorRT workflow can trigger out-of-bounds memory access. Successful exploitation may result in code execution within the context of the affected process.
NVIDIA published a customer support advisory describing the flaw and remediation guidance. The issue requires user interaction and local access, which limits remote exposure but remains relevant on multi-tenant inference hosts and developer workstations.
Critical Impact
Local exploitation can lead to arbitrary code execution, integrity loss, and denial of service within TensorRT-hosting processes on Windows and Linux systems.
Affected Products
- NVIDIA TensorRT (all versions prior to the fix referenced in NVIDIA advisory ID 5855)
- Systems running TensorRT inference pipelines on Linux and Windows
- AI/ML developer workstations and inference servers using vulnerable TensorRT builds
Discovery Timeline
- 2026-07-14 - CVE-2026-24238 published to NVD
- 2026-07-17 - Last updated in NVD database
Technical Details for CVE-2026-24238
Vulnerability Analysis
The flaw is classified under [CWE-129]: Improper Validation of Array Index. TensorRT fails to correctly bound-check an index value before using it to access an array element. When an attacker supplies a crafted model, engine file, or input tensor, the unchecked index drives memory access outside the intended buffer.
Out-of-bounds access in native inference code can corrupt adjacent memory structures. Depending on the memory layout, attackers can influence function pointers, virtual tables, or heap metadata. This creates the conditions required for arbitrary code execution within the TensorRT process.
The attack requires local access and user interaction, meaning a victim must load or process attacker-controlled content. TensorRT engines and plans are common exchange artifacts in ML pipelines, increasing the practical attack surface.
Root Cause
The root cause is missing or insufficient bounds checking on an array index derived from untrusted input. The vulnerable code path uses the index directly in a memory access operation instead of validating it against the array length. Refer to the NVIDIA Customer Support Advisory for the specific components involved.
Attack Vector
An attacker distributes a malicious TensorRT engine, ONNX model, or input file to a target user. When the victim loads the artifact into a vulnerable TensorRT runtime, the improper index validation triggers out-of-bounds memory access. The attacker gains code execution in the context of the user running the inference workload. See the NIST CVE-2026-24238 Details for the full attack scenario.
No public proof-of-concept exploit is available at the time of publication. No exploitation in the wild has been reported, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-24238
Indicators of Compromise
- Unexpected crashes, segmentation faults, or access violations in processes loading TensorRT libraries
- TensorRT engine or model files originating from untrusted sources or shared repositories
- Child processes spawned by inference workloads that do not match expected application behavior
- Anomalous memory allocations or heap corruption events in AI/ML host processes
Detection Strategies
- Inventory all hosts running NVIDIA TensorRT and correlate installed versions against the fixed release listed in NVIDIA advisory 5855
- Monitor process telemetry for TensorRT-linked binaries loading models from non-standard directories or user-writable paths
- Enable crash reporting and core dump collection on inference servers to detect exploitation attempts that fail silently
Monitoring Recommendations
- Log and review all model file introductions to production inference environments, including hashes and provenance
- Alert on TensorRT processes making unusual outbound network connections or writing to sensitive filesystem locations
- Track EDR telemetry for behavioral anomalies in Python interpreters and inference services that load TensorRT
How to Mitigate CVE-2026-24238
Immediate Actions Required
- Apply the TensorRT update referenced in the NVIDIA Customer Support Advisory to all affected systems
- Restrict loading of TensorRT engine and model files to trusted, signed sources only
- Isolate inference workloads that must process untrusted input using containers or dedicated low-privilege accounts
- Audit CI/CD pipelines that build or consume TensorRT engines for supply chain risks
Patch Information
NVIDIA has released fixed TensorRT versions addressed in advisory ID 5855. Consult the NVIDIA Customer Support Advisory for exact version numbers, supported platforms, and download instructions. Apply patches on all Linux and Windows systems running TensorRT, including developer laptops, training clusters, and production inference nodes.
Workarounds
- Do not load TensorRT engine or model files received from untrusted or unverified sources
- Run TensorRT-based applications under least-privilege service accounts to limit code execution impact
- Enforce file integrity monitoring on model repositories to detect unauthorized modifications
- Segment ML inference infrastructure from general enterprise networks to contain potential compromise
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
