Is CVE-2025-33255 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-33255 being exploited in the wild.

How severe is CVE-2025-33255?

High severity, with a CVSS score of 7.5, published 20 May 2026.

Is there a fix for CVE-2025-33255?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-33255 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2025-33255?

Check whether you run Nvidia TRT-LLM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-33255: NVIDIA TRT-LLM unsafe deserialization in MPI server

CVE-2025-33255 · Severity: high · CVSS 7.5 · Published 2026-05-20

NVIDIA TRT-LLM, a library used to accelerate the performance of Large Language Models, contains a security vulnerability in its MPI server component. An attacker with high-level local access could exploit this flaw to execute unauthorized commands or disrupt AI services. This could lead to a complete system takeover, data theft, or permanent damage to the integrity of the AI models being served.

Technologies: Nvidia TRT-LLM. Vendors: Nvidia.

Quick answers

Is CVE-2025-33255 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-33255 being exploited in the wild.
How severe is CVE-2025-33255?: High severity, with a CVSS score of 7.5, published 20 May 2026.
Which products and versions are affected?: Nvidia TRT-LLM All platforms.
Is there a fix for CVE-2025-33255?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-33255 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2025-33255?: Check whether you run Nvidia TRT-LLM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the MPI (Message Passing Interface) server component of NVIDIA TRT-LLM due to the unsafe deserialization of untrusted data (CWE-502). The flaw requires the attacker to have local access with high privileges and involves a high level of complexity to exploit. If successfully exploited, the attacker can achieve arbitrary code execution with the potential to escape the immediate environment (Scope: Changed), leading to full compromise of confidentiality, integrity, and availability. Users are advised to refer to NVIDIA advisory a_id/5805 for specific patching instructions.

Affected products

NVIDIA TRT-LLM All platforms

Timeline

2026-05-20: disclosed: Initial public disclosure by NVIDIA

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.