CVE-2026-24268: Nvidia TensorRT Buffer Overflow Vulnerability

CVE-2026-24268 Overview

CVE-2026-24268 is a heap-based buffer overflow vulnerability in NVIDIA TensorRT, a high-performance deep learning inference library used to optimize and deploy machine learning models on NVIDIA GPUs. An attacker with local access can trigger memory corruption on the heap, potentially leading to arbitrary code execution in the context of the process using TensorRT. Exploitation requires user interaction, such as loading a malicious model or engine file. The vulnerability is tracked under CWE-122: Heap-Based Buffer Overflow.

Critical Impact
Successful exploitation may allow local attackers to execute code, corrupt data, and compromise the confidentiality, integrity, and availability of systems running vulnerable TensorRT builds.

Affected Products

NVIDIA TensorRT (versions listed in the NVIDIA Support Article)
Applications and inference pipelines that link against affected TensorRT libraries
AI/ML workloads on NVIDIA GPUs relying on TensorRT for model optimization

Discovery Timeline

2026-07-14 - CVE-2026-24268 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-24268

Vulnerability Analysis

The vulnerability resides in NVIDIA TensorRT's handling of untrusted input data on the heap. When TensorRT processes a specially crafted model or input structure, insufficient bounds validation allows a write operation to exceed the allocated heap buffer. This condition corrupts adjacent memory regions, including heap metadata and neighboring object data.

An attacker who controls the overflow can influence program execution flow. Depending on heap layout and allocator behavior, this can lead to arbitrary code execution within the privilege level of the TensorRT-consuming process. Because TensorRT is embedded in inference servers, GPU-accelerated services, and ML pipelines, successful exploitation may reach process contexts that hold access to models, data, or credentials.

Root Cause

The root cause is inadequate bounds checking on heap-allocated buffers during parsing or processing of attacker-influenced data. Missing or incorrect size validation permits writes past the intended buffer boundary, corrupting the heap. This class of defect is cataloged as CWE-122.

Attack Vector

Exploitation requires local access and user interaction. A typical scenario involves an operator opening or loading a malicious TensorRT engine file, ONNX model, or plan file supplied by an attacker. The scope is unchanged, meaning impact is contained to the vulnerable process, but the confidentiality, integrity, and availability impacts are each rated high.

No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Detailed exploitation mechanics are not disclosed by NVIDIA. Refer to the NVIDIA Support Article for vendor guidance.

Detection Methods for CVE-2026-24268

Indicators of Compromise

Unexpected crashes or segmentation faults in processes linked against TensorRT libraries such as libnvinfer.so or nvinfer.dll.
Loading of TensorRT engine, plan, or ONNX model files from untrusted or unusual filesystem locations.
Anomalous child processes or shell spawns originating from inference services or ML worker processes.

Detection Strategies

Inventory hosts and containers running TensorRT and cross-reference installed versions against the fixed versions in the NVIDIA advisory.
Monitor for file writes and reads of TensorRT model artifacts by non-standard users or processes.
Enable core dump collection on ML inference hosts to identify heap corruption patterns consistent with buffer overflow exploitation.

Monitoring Recommendations

Baseline expected process behavior for ML inference services and alert on deviations, including new outbound network connections or privilege changes.
Track integrity of model files with hashing and file integrity monitoring to detect tampering or replacement.
Correlate GPU workload telemetry with endpoint process events to identify suspicious model loads that trigger crashes.

How to Mitigate CVE-2026-24268

Immediate Actions Required

Apply the TensorRT updates described in the NVIDIA Support Article to all affected hosts, containers, and images.
Restrict local access to systems running TensorRT to trusted operators only, and enforce least privilege for inference service accounts.
Treat all TensorRT engine, plan, and ONNX files as untrusted input and validate their source before loading.

Patch Information

NVIDIA has published fixed versions and remediation guidance in security bulletin Answer ID 5855. Administrators should identify affected TensorRT installations, upgrade to the vendor-provided patched release, and rebuild any container images or ML pipelines that bundle the vulnerable library. Redeploy inference services after verification.

Workarounds

Load only TensorRT models produced by trusted internal build pipelines and signed by verified publishers.
Isolate inference workloads in sandboxed containers or virtual machines with minimal privileges and no sensitive credential access.
Disable or gate model-loading functionality that accepts user-supplied files until patches are deployed.

bash

# Example: check installed TensorRT version on Linux
dpkg -l | grep -i tensorrt
# or, for pip-based installs
pip show tensorrt