NVIDIA TensorRT-LLM contains an unsafe deserialization flaw in its RPC testing feature that can lead to code execution, denial of service, data tampering, and information disclosure. The weakness is classified as CWE-502, indicating that untrusted data is deserialized without proper validation, allowing malicious payloads to be processed by the system.

All versions of NVIDIA TensorRT-LLM on any platform are affected. No specific version numbers are listed, so any deployment using this component should be treated as vulnerable until confirmed otherwise.

The CVSS score is 7.5, indicating a high severity vulnerability. EPSS information is not available, so the current exploitation probability cannot be quantified, but the lack of a KEV listing suggests no publicly known exploits at this time. Based on the description, the likely attack vector is via the RPC testing interface, which an attacker could reach from a remote client to send a maliciously crafted serialized payload. Successful exploitation would allow arbitrary code execution on the host running TensorRT-LLM.