Deserialization Vulnerability in NVIDIA TensorRT-LLM for Linux

CVE-2026-24233

What is CVE-2026-24233?

NVIDIA TensorRT-LLM for Linux has a vulnerability in its restricted unpickler responsible for model weight deserialization. This flaw allows a local, unauthenticated attacker to exploit the system by triggering the deserialization of untrusted data. If successfully exploited, the attacker could execute arbitrary code, escalate user privileges, manipulate data, and potentially disclose sensitive information. Organizations using this product should implement necessary patches and security measures to mitigate the risks associated with this vulnerability.

References