CVE-2026-24163: High Deserialization Flaw in NVIDIA TensorRT-LLM

CVE-2026-24163 is a high severity (CVSS 7.5) unsafe deserialization flaw in NVIDIA TensorRT-LLM, in the RPC testing code. NVIDIA fixed it in TensorRT-LLM v1.2. Every earlier version is affected, so update to v1.2 or later, and note that NVIDIA's bulletin recommends v1.2.1.

What's affected

NVIDIA's May 2026 TensorRT-LLM bulletin lists all versions before v1.2 as affected on all platforms, with v1.2 as the updated version. The same bulletin covers four other CVEs, and one of them is fixed in v1.2.1, which is why NVIDIA tells users to clone or update to v1.2.1.

The attack vector in the CVSS record is local, the attack complexity is high and the privileges required are high. That narrows who can reach the flaw, but the impact scores are high for confidentiality, integrity and availability.

How to check if you're exposed

Find the installed version on each host or container that runs TensorRT-LLM:

pip show tensorrt_llm

If you build from source, check which release tag or commit you cloned. Anything older than v1.2 is in range. Also look in your container images and CI runners, because inference tooling is often baked into images nobody revisits.

For a quick look at your own dependencies, Safeguard's free in-browser dependency scan at https://gold.safeguard.sh/scan checks them against known CVEs in your browser.

What to do now

1. Update TensorRT-LLM to v1.2 or later. NVIDIA's bulletin points to v1.2.1.
2. Rebuild and redeploy any container image that pins an older release.
3. For multi-GPU deployments, read NVIDIA's mitigation note about the trtllm-llmapi-launch executable. It is listed against a different CVE in the same bulletin, but it is cheap hardening.
4. Restrict who has local, privileged access to the hosts running inference.

Why it matters

The weakness is CWE-502, deserialization of untrusted data. Deserializing data can rebuild objects the program never meant to create, and in some runtimes that leads to code execution. NVIDIA lists code execution, denial of service, data tampering and information disclosure as possible impacts.

The CVSS vector needs local access and high privileges, so this is not a remote, unauthenticated problem. It still matters on shared GPU hosts, where several teams or services run side by side. It is not listed in CISA's Known Exploited Vulnerabilities catalog.

Inference infrastructure needs normal patch discipline

AI serving stacks grew quickly, often owned by research or platform teams, and they pull in many native libraries. They deserve the same inventory and patch rhythm as any production service.

The May 2026 TensorRT-LLM bulletin covers five CVEs across three weakness classes. Two are deserialization flaws in code that handles inter-process communication, one is a race condition and one a null pointer problem. It is a reminder that a single bulletin often asks for a single upgrade. NVIDIA's table lists v1.2 for most of the set and v1.2.1 for the race condition, so going straight to v1.2.1 clears the lot.

Where to look

Check the places that people forget: base images for GPU nodes, notebooks that install a pinned version, and CI jobs that run model tests. Pinned versions in requirements files and container recipes are the usual reason an old release lingers months after a fix is out.

Narrow the local attack surface

The CVSS vector is local with high privileges, so reducing who can run code on inference hosts reduces the risk. Avoid sharing hosts between teams with different trust levels, keep interactive shells off production inference nodes, and review which service accounts can talk to the inter-process endpoints the library opens.

Multi-GPU launch note

NVIDIA's mitigation line applies to CVE-2025-33255 in the same bulletin: for multi-GPU deployments, use the trtllm-llmapi-launch executable rather than creating the RPC server class directly. It is not listed against this CVE, but it follows the same theme of keeping control channels away from direct use, so adopt it if it fits your deployment.

Make it routine

Add the framework to your software inventory with its version, and subscribe to NVIDIA's security bulletins. Then each new bulletin becomes a lookup and a ticket.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• NVIDIA Security Bulletin: TensorRT-LLM, May 2026

Last reviewed: 19 October 2026.