CVE-2026-47471: NVIDIA TensorRT-LLM Buffer Overflow Flaw

CVE-2026-47471 Overview

CVE-2026-47471 is a heap-based buffer overflow vulnerability in NVIDIA TensorRT-LLM affecting any platform where the library is deployed. The flaw resides in the tensor deserialization logic, where attacker-controlled input can overflow a heap buffer during parsing. An attacker positioned on an adjacent network can trigger the condition without authentication or user interaction. Successful exploitation may lead to information disclosure, data tampering, or denial of service against inference workloads. The weakness is categorized under CWE-122: Heap-based Buffer Overflow.

Critical Impact
Attackers with adjacent network access can corrupt heap memory in TensorRT-LLM inference processes, resulting in denial of service, tampering of model outputs, or disclosure of process memory.

Affected Products

NVIDIA TensorRT-LLM (all supported platforms)
Inference workloads relying on TensorRT-LLM tensor deserialization
Multi-tenant GPU environments exposing TensorRT-LLM endpoints on local networks

Discovery Timeline

2026-07-14 - CVE-2026-47471 published to the National Vulnerability Database
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-47471

Vulnerability Analysis

The vulnerability resides in the tensor deserialization path within TensorRT-LLM. During deserialization, the library reconstructs tensor objects from a serialized byte stream that includes metadata such as shape, data type, and element count. Insufficient validation of these fields allows a malformed payload to drive a subsequent heap allocation and copy operation past the intended bounds.

Because deserialization occurs before the tensor is used for inference, exploitation does not require valid model input. An attacker who can submit a crafted tensor payload to a TensorRT-LLM service can corrupt adjacent heap structures. Depending on allocator state, this can leak process memory, alter model output, or crash the inference worker.

Root Cause

The root cause is missing or incorrect bounds validation between the declared tensor metadata and the actual buffer size used during deserialization. This is a classic [CWE-122] pattern in which trusted size fields drive untrusted-length copies into heap-allocated regions.

Attack Vector

The attack vector is Adjacent Network, meaning the attacker must reach the vulnerable service from the same logical network segment such as a shared VLAN, container network, or GPU cluster fabric. No privileges or user interaction are required. Attack complexity is high because the attacker must shape the payload to reliably trigger the overflow given allocator and layout constraints.

Exploitation involves sending a malformed serialized tensor to any endpoint that invokes the vulnerable deserialization routine, such as an internal inference gateway, model-loading pipeline, or inter-process tensor exchange channel.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-47471

Indicators of Compromise

Unexpected crashes, segmentation faults, or restarts of TensorRT-LLM inference workers
Anomalous inbound connections to inference service ports from adjacent hosts that do not normally communicate with the GPU tier
Malformed or oversized serialized tensor payloads observed in application logs
Inference outputs that deviate from expected model behavior without a corresponding model update

Detection Strategies

Enable core dump collection on TensorRT-LLM processes and alert on repeated crashes originating from deserialization call stacks
Instrument inference gateways to log payload sizes and reject requests exceeding expected tensor dimensions
Correlate GPU worker restarts with network flow data to identify the source of malformed inputs

Monitoring Recommendations

Monitor east-west network traffic to inference services and baseline expected client identities
Track process memory usage and crash frequency of TensorRT-LLM workers as a health signal
Ingest inference service logs into a centralized analytics platform and alert on deserialization errors

How to Mitigate CVE-2026-47471

Immediate Actions Required

Inventory all deployments of NVIDIA TensorRT-LLM across development, staging, and production GPU clusters
Restrict network reachability of TensorRT-LLM endpoints to authenticated client services only
Apply the vendor security update as soon as NVIDIA publishes a fixed release for TensorRT-LLM
Enable crash reporting and forward inference service logs to a monitored location

Patch Information

Consult the NVD entry for CVE-2026-47471 and the CVE.org record for the authoritative advisory and fixed version references. Upgrade to the NVIDIA-provided patched build of TensorRT-LLM once available and validate that all inference workers, sidecars, and container images are rebuilt from the fixed release.

Workarounds

Place TensorRT-LLM services behind an authenticated API gateway that validates tensor payload structure and size before forwarding
Segment GPU inference nodes onto a dedicated network with strict ingress controls to eliminate adjacent-network exposure
Reject or sanitize serialized tensor inputs originating from untrusted tenants in multi-tenant deployments
Run TensorRT-LLM workers under least-privilege service accounts and enable automatic process restart to limit denial-of-service impact

bash

# Example: restrict TensorRT-LLM inference port to a trusted client subnet
iptables -A INPUT -p tcp --dport 8000 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP