CVE-2026-47472: NVIDIA TensorRT-LLM RCE Vulnerability

CVE-2026-47472 Overview

CVE-2026-47472 is an insecure deserialization vulnerability in NVIDIA TensorRT-LLM, affecting the inter-process communication (IPC) layer. An attacker with local same-user access can trigger unsafe deserialization of untrusted data processed by the IPC channel. Successful exploitation can lead to arbitrary code execution, information disclosure, data tampering, and denial of service against the affected TensorRT-LLM process.

The vulnerability is categorized under [CWE-502] Deserialization of Untrusted Data. It carries a local attack vector with low complexity and low privilege requirements, and impacts confidentiality, integrity, and availability of the host workload running TensorRT-LLM.

Critical Impact
A local, authenticated attacker sharing the same user context as the TensorRT-LLM process can execute arbitrary code, tamper with model inference data, and disrupt inference services.

Affected Products

NVIDIA TensorRT-LLM (inter-process communication layer)
Deployments running TensorRT-LLM inference workloads on Linux hosts
Containerized AI inference stacks bundling vulnerable TensorRT-LLM releases

Discovery Timeline

2026-07-14 - CVE-2026-47472 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-47472

Vulnerability Analysis

TensorRT-LLM uses inter-process communication to coordinate work between components involved in large language model inference. The affected IPC layer deserializes objects received over local channels without sufficient validation of the payload structure or type. When a malicious payload is processed, the deserialization routine reconstructs attacker-controlled objects inside the target process.

Because the attacker operates as the same local user as the TensorRT-LLM process, the payload is delivered through an IPC endpoint the attacker can already reach. The reconstructed objects can invoke code paths chosen by the attacker during deserialization. This results in code execution within the address space and privileges of the inference process.

The impact extends beyond code execution. Attackers can read sensitive model data, prompts, and inference results in memory. They can also tamper with tensors or control-flow state to alter model outputs, or crash worker processes to deny service to downstream applications.

Root Cause

The root cause is unsafe deserialization of untrusted input received on the IPC channel, aligning with [CWE-502]. The IPC layer trusts serialized data delivered by any process running under the same user identity, rather than restricting deserialization to a safe subset of types or requiring cryptographic integrity checks on messages.

Attack Vector

Exploitation requires local access with the ability to run code as the same user account that owns the TensorRT-LLM process. The attacker crafts a malicious serialized payload and sends it to the IPC endpoint exposed by TensorRT-LLM. When the target process deserializes the payload, attacker-controlled logic executes. No user interaction is required, and the scope remains within the compromised process context.

No public proof-of-concept exploit is currently listed for this CVE, and it is not present on the CISA Known Exploited Vulnerabilities catalog. Refer to the NVD CVE-2026-47472 Details and the CVE.org Record for CVE-2026-47472 for the authoritative vulnerability record.

Detection Methods for CVE-2026-47472

Indicators of Compromise

Unexpected child processes spawned by TensorRT-LLM worker processes, especially shells or interpreters such as bash, sh, or python.
Unusual outbound network connections initiated by inference processes that normally only communicate locally.
Anomalous writes to model directories, configuration files, or user home directories by the TensorRT-LLM process user.

Detection Strategies

Baseline the expected process tree and IPC endpoints for TensorRT-LLM deployments, and alert on deviations.
Monitor for local processes writing to or connecting to TensorRT-LLM IPC sockets, shared memory segments, or pipes outside of expected orchestration components.
Inspect Python and native library load events inside inference containers for unexpected modules loaded at runtime.

Monitoring Recommendations

Enable auditd or eBPF-based syscall monitoring on hosts running TensorRT-LLM to capture execve, connect, and IPC-related calls.
Aggregate inference host telemetry into a centralized data lake for correlation with authentication and container runtime events.
Alert on any interactive session that occurs under the service account used to run TensorRT-LLM.

How to Mitigate CVE-2026-47472

Immediate Actions Required

Upgrade TensorRT-LLM to a fixed release as published in the NVIDIA security advisory once available.
Restrict local access to hosts and containers running TensorRT-LLM to trusted administrators and service accounts only.
Run TensorRT-LLM under a dedicated, unprivileged service account that no other workloads share.

Patch Information

At the time of publication, this CVE record does not enumerate specific fixed versions in the NVD entry. Consult NVIDIA's product security advisories for TensorRT-LLM and apply the vendor-designated patched release. Verify the deployed version after upgrade and rebuild any container images that bundle the vulnerable library.

Workarounds

Isolate TensorRT-LLM processes in dedicated containers or namespaces to prevent other workloads from sharing the same user context.
Enforce mandatory access controls such as SELinux or AppArmor profiles that restrict which processes may connect to TensorRT-LLM IPC endpoints.
Remove interactive login capabilities for the service account that runs TensorRT-LLM to reduce the local same-user attack surface.

bash

# Configuration example: run TensorRT-LLM under a dedicated service account
# and restrict IPC socket permissions

sudo useradd --system --shell /usr/sbin/nologin trtllm
sudo install -d -o trtllm -g trtllm -m 0700 /var/run/trtllm

# Example systemd hardening for a TensorRT-LLM service unit
# [Service]
# User=trtllm
# Group=trtllm
# NoNewPrivileges=true
# PrivateTmp=true
# ProtectSystem=strict
# ProtectHome=true
# RuntimeDirectory=trtllm
# RuntimeDirectoryMode=0700