Technical impact
The vulnerability is a heap-based buffer overflow that occurs during tensor deserialization in NVIDIA TensorRT‑LLM. An attacker that can supply malicious tensor data could trigger the overflow, potentially leading to information disclosure, data tampering, or denial of service. The weakness is identified as CWE‑122, a classic heap buffer overflow flaw.
Affected Systems
All platforms running NVIDIA TensorRT‑LLM are affected. No specific version information is listed, so any deployment of this library is potentially vulnerable until a patch is applied.
Risk and Exploitability
The CVSS score of 7.5 indicates a high severity, but the EPSS value of less than 1% suggests a very low likelihood of real‑world exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker being able to supply crafted tensor input to the deserialization routine; remote exploitation would require some form of exposed tensor input interface, while local exploitation would require the attacker to have access to the system’s memory space.
