CVE-2026-47473: NVIDIA TensorRT-LLM DoS Vulnerability

CVE-2026-47473 Overview

CVE-2026-47473 is a write-what-where vulnerability in NVIDIA TensorRT-LLM, the open-source library used to optimize and deploy large language model (LLM) inference on NVIDIA GPUs. An attacker with local access can trigger a condition that allows writing controlled data to a controlled memory location [CWE-123]. Successful exploitation may result in data tampering, denial of service, and information disclosure across the affected inference workloads.

Critical Impact
A local attacker can corrupt arbitrary memory in TensorRT-LLM processes, undermining the confidentiality, integrity, and availability of LLM inference services running on affected NVIDIA GPU hosts.

Affected Products

NVIDIA TensorRT-LLM (vendor advisory required for specific fixed versions)
Deployments running TensorRT-LLM inference on NVIDIA GPU hosts
Container images and MLOps pipelines that bundle vulnerable TensorRT-LLM builds

Discovery Timeline

2026-07-14 - CVE-2026-47473 published to the National Vulnerability Database (NVD)
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-47473

Vulnerability Analysis

The flaw is classified under [CWE-123] Write-What-Where Condition. This weakness lets an attacker specify both the value written and the destination address in memory. In the context of TensorRT-LLM, the primitive can be abused to overwrite function pointers, control structures, or model tensors within the inference process.

Exploitation requires local access to a host running TensorRT-LLM. The attack complexity is high because it depends on winning specific runtime conditions or crafting malicious inputs that reach the vulnerable code path. Once triggered, the primitive impacts confidentiality, integrity, and availability of the inference workload.

Root Cause

A write-what-where condition arises when the software fails to validate a destination pointer or index before performing a write operation with attacker-influenced data. In TensorRT-LLM, this typically involves untrusted input flowing into pointer arithmetic, tensor indexing, or serialized model handling without proper bounds checking. NVIDIA has not published the specific vulnerable component in the public advisory referenced by NVD.

Attack Vector

The attack vector is local. The attacker needs the ability to submit inputs or artifacts processed by TensorRT-LLM, such as engine files, model plugins, or inference requests handled by the runtime. No authentication is required at the vulnerable interface, and no user interaction is needed to complete the write primitive.

No public exploit code, proof of concept, or CISA Known Exploited Vulnerabilities (KEV) listing exists for CVE-2026-47473 at the time of publication. Refer to the NVD CVE-2026-47473 Detail and the CVE.org Record for CVE-2026-47473 for authoritative details.

Detection Methods for CVE-2026-47473

Indicators of Compromise

Unexpected crashes, segmentation faults, or restarts of TensorRT-LLM inference processes on GPU hosts.
Corruption of model outputs or tensor state that cannot be attributed to normal inference variance.
Unusual file writes or memory-mapped regions created by TensorRT-LLM runtime users.

Detection Strategies

Inventory hosts and container images running TensorRT-LLM and correlate against the fixed versions listed in NVIDIA's security bulletin.
Monitor for anomalous child processes, library loads, or plugin registrations under the TensorRT-LLM runtime.
Enable core dump collection on inference hosts to capture evidence of memory corruption for forensic review.

Monitoring Recommendations

Ingest GPU host telemetry, container runtime logs, and MLOps pipeline events into a centralized data lake with retention sufficient for incident review.
Alert on repeated abnormal termination of TensorRT-LLM services, which can indicate exploitation attempts against the write-what-where primitive.
Track access to model artifacts and engine files, treating unauthorized modification as a high-severity event.

How to Mitigate CVE-2026-47473

Immediate Actions Required

Identify all systems running NVIDIA TensorRT-LLM and prioritize patching hosts that process untrusted models, prompts, or plugins.
Restrict local access to inference hosts using least-privilege principles and hardened container isolation.
Validate the integrity and provenance of model files, engine files, and plugins before loading them into TensorRT-LLM.

Patch Information

NVIDIA is the authoritative source for fixed versions of TensorRT-LLM. Consult NVIDIA's security bulletins and the NVD CVE-2026-47473 Detail for the specific patched release and upgrade instructions. Apply the vendor-supplied patch as soon as it is available in your environment.

Workarounds

Limit TensorRT-LLM execution to trusted users and service accounts, and disable multi-tenant access on affected hosts until patched.
Run inference workloads inside sandboxed containers with seccomp, AppArmor, or SELinux profiles that constrain filesystem and syscall access.
Block loading of untrusted TensorRT-LLM plugins and engine files sourced outside of controlled model registries.

bash

# Configuration example: restrict TensorRT-LLM runtime and audit model loads
# 1. Run inference containers as a dedicated non-root user
docker run --rm \
  --user 10001:10001 \
  --read-only \
  --security-opt no-new-privileges \
  --cap-drop ALL \
  --gpus all \
  -v /srv/models:/models:ro \
  tensorrt-llm:patched

# 2. Audit access to model and engine files
auditctl -w /srv/models -p wa -k trtllm_model_write