CVE-2026-24272: Nvidia TensorRT Buffer Overflow Vulnerability

CVE-2026-24272 Overview

NVIDIA TensorRT contains a heap-based buffer overflow vulnerability [CWE-122] that can lead to arbitrary code execution. The flaw affects the TensorRT inference optimization library used in production AI/ML deployments. An attacker with local access can trigger the overflow by supplying a crafted input that causes TensorRT to write beyond an allocated heap buffer. Successful exploitation requires user interaction, such as loading a malicious model or engine file. The vulnerability impacts confidentiality, integrity, and availability. NVIDIA published this issue in a customer support advisory and assigned it CVE-2026-24272.

Critical Impact
Successful exploitation can result in arbitrary code execution in the context of the process loading a malicious TensorRT model, along with data tampering and denial of service.

Affected Products

NVIDIA TensorRT (all supported versions prior to the fixed release referenced in NVIDIA advisory ID 5855)
AI/ML inference pipelines that load third-party or untrusted TensorRT engine files
Applications embedding the TensorRT runtime for GPU-accelerated inference

Discovery Timeline

2026-07-14 - CVE CVE-2026-24272 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-24272

Vulnerability Analysis

The vulnerability is classified as a Heap-Based Buffer Overflow [CWE-122] within NVIDIA TensorRT. TensorRT is a high-performance deep learning inference library that parses model definitions, serialized engines, and plugin data. When TensorRT processes a malformed input structure, it fails to correctly validate the size of data before copying it into a heap-allocated buffer. The out-of-bounds write corrupts adjacent heap metadata or object pointers. An attacker who controls the overflowed data can hijack execution flow. Because the attack vector is local and requires user interaction, exploitation typically occurs when a user loads an attacker-supplied model file or engine artifact.

Root Cause

The root cause is insufficient bounds checking during deserialization or parsing of input data consumed by the TensorRT runtime. The code path allocates a fixed or size-derived heap region and then copies attacker-controlled bytes without enforcing the destination buffer's capacity. This mismatch between declared and actual sizes enables the overflow into adjacent heap memory.

Attack Vector

Exploitation requires local access to the host running TensorRT and user interaction to load the malicious artifact. Common delivery paths include distributing a weaponized .engine file, a crafted ONNX model, or a plugin binary through model-sharing platforms, internal ML pipelines, or supply chain repositories. NVIDIA has not disclosed public proof-of-concept code, and no exploit is currently available in ExploitDB. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified public exploit code is available for this vulnerability. Refer to the NVIDIA Customer Support Advisory for authoritative technical details.

Detection Methods for CVE-2026-24272

Indicators of Compromise

Unexpected process crashes or segmentation faults originating from TensorRT runtime libraries during model load or inference
Loading of TensorRT engine or model files from untrusted sources, network shares, or user download directories
Anomalous child processes spawned by inference applications that embed TensorRT
GPU-adjacent processes exhibiting shellcode-like behavior or unexpected outbound network connections after model loading

Detection Strategies

Inventory hosts running TensorRT and correlate installed versions against the fixed release listed in NVIDIA advisory ID 5855
Monitor for file writes of .engine, .plan, or .onnx files into directories consumed by production inference services
Implement behavioral detections for process crashes followed by suspicious execution chains from trtexec or Python inference workers

Monitoring Recommendations

Enable core dump collection on inference hosts to identify heap corruption signatures
Log all model and engine file loads with hash, source, and user identity for forensic reconstruction
Alert on TensorRT-linked processes performing unexpected filesystem, registry, or network operations

How to Mitigate CVE-2026-24272

Immediate Actions Required

Apply the TensorRT update referenced in NVIDIA advisory ID 5855 across all affected inference hosts and developer workstations
Restrict which users and services can supply model artifacts to production TensorRT runtimes
Treat all externally sourced TensorRT engines and ONNX models as untrusted until validated in an isolated environment
Audit ML pipelines for automated ingestion of third-party models and add integrity verification

Patch Information

NVIDIA has released fixed versions of TensorRT. Refer to the NVIDIA Customer Support Advisory for the specific fixed version numbers, download links, and platform-specific packages. Update all instances of TensorRT libraries, including those embedded in container images and application bundles. Additional references are available in the NVD CVE-2026-24272 record and the CVE.org Record for CVE-2026-24272.

Workarounds

Load only TensorRT models and engines from trusted internal sources with verified cryptographic signatures
Run inference workloads in isolated containers or sandboxes with minimal privileges and no outbound network access
Disable dynamic loading of user-supplied plugins in TensorRT-enabled applications where feasible
Segment GPU inference hosts from user-facing systems to reduce local access exposure

bash

# Configuration example: verify TensorRT package version on Linux
dpkg -l | grep -i tensorrt
# Or via pip for Python bindings
pip show tensorrt

# Validate model file integrity before loading
sha256sum /path/to/model.engine

# Restrict permissions on model directories
chown -R inference-svc:inference-svc /opt/models
chmod -R 750 /opt/models