On 14 July 2026, NVD published CVE-2026-47472, a deserialization flaw in the inter-process communication layer of NVIDIA TensorRT-LLM. According to the record, an attacker with local same-user access can cause deserialization of untrusted data, which might lead to code execution, information disclosure, data tampering and denial of service. The CVSS 3.1 score is 7.8, with a local attack vector and low privileges required.
The record lists weakness type CWE-502. It does not list affected or fixed version numbers, and NVD's entry was last modified on 15 July.
What's affected
TensorRT-LLM, NVIDIA's library for optimized LLM inference, when its IPC layer processes data from a process running as the same OS user. Because the NVD entry gives no version range, read NVIDIA's product security bulletin for the fixed release before you decide which builds to treat as vulnerable.
The local requirement narrows the risk. This is not an internet-facing remote code execution bug. It becomes serious on shared machines, in containers where several workloads run under one user, and anywhere an attacker who already has a foothold can use it to reach more of the system.
What to do now
- Inventory where TensorRT-LLM runs, including containers that bundle it, and record the version in each.
- Check NVIDIA's security bulletin for the fixed release and plan the upgrade.
- Run inference workers under a dedicated OS user, so other processes on the host do not share an identity with them.
- Avoid running untrusted code, notebooks or plugins on the same user account as the inference service.
- Limit access to the sockets or files used for IPC with filesystem permissions.
How this could have been avoided
- Use a data-only serialization format for IPC. The flaw exists because the channel deserializes data into objects. A schema-based format cannot rebuild arbitrary code.
- Authenticate the peer on local channels. "Same user" is a weak trust boundary. Checking who is connecting would shrink the pool of attackers.
- Separate identities between workloads. Running each service as its own user turns a same-user bug into one that needs a prior compromise of that exact account.
Quick check
Why does the same-user requirement matter for prioritizing CVE-2026-47472?
The attacker already needs local access as the same user, so exposure is highest on shared hosts and containers, and lowest on single-purpose machines with no other workloads.
