# CVE-2025-33255: NVIDIA TRT-LLM unsafe deserialization in MPI server

Source: https://junglewise.ai/threats/cve-2025-33255-nvidia-trt-llm-unsafe-deserialization-in-mpi-server  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-20. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

CVE-2025-33255 · Severity: high · CVSS 7.5 · Published 2026-05-20

NVIDIA TRT-LLM, a library used to accelerate the performance of Large Language Models, contains a security vulnerability in its MPI server component. An attacker with high-level local access could exploit this flaw to execute unauthorized commands or disrupt AI services. This could lead to a complete system takeover, data theft, or permanent damage to the integrity of the AI models being served.

Technologies: [Nvidia TRT-LLM](https://junglewise.ai/threats/technologies/trt-llm). Vendors: [Nvidia](https://junglewise.ai/threats/vendors/nvidia).

## Quick answers

**Is CVE-2025-33255 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-33255 being exploited in the wild.

**How severe is CVE-2025-33255?** High severity, with a CVSS score of 7.5, published 20 May 2026.

**Which products and versions are affected?** Nvidia TRT-LLM All platforms.

**Is there a fix for CVE-2025-33255?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-33255 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2025-33255?** Check whether you run Nvidia TRT-LLM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the MPI (Message Passing Interface) server component of NVIDIA TRT-LLM due to the unsafe deserialization of untrusted data (CWE-502). The flaw requires the attacker to have local access with high privileges and involves a high level of complexity to exploit. If successfully exploited, the attacker can achieve arbitrary code execution with the potential to escape the immediate environment (Scope: Changed), leading to full compromise of confidentiality, integrity, and availability. Users are advised to refer to NVIDIA advisory a_id/5805 for specific patching instructions.

## Affected products

- NVIDIA TRT-LLM All platforms

## Timeline

- 2026-05-20: disclosed: Initial public disclosure by NVIDIA

## References

- [https://nvidia.custhelp.com/app/answers/detail/a_id/5805](https://nvidia.custhelp.com/app/answers/detail/a_id/5805)
- [https://www.cve.org/CVERecord?id=CVE-2025-33255](https://www.cve.org/CVERecord?id=CVE-2025-33255)

## Related threats

- [NVIDIA TRT-LLM unsafe deserialization in RPC testing](https://junglewise.ai/threats/cve-2026-24163-nvidia-trt-llm-unsafe-deserialization-in-rpc-testing)
- [NVIDIA TRT-LLM null pointer dereference causing DoS](https://junglewise.ai/threats/cve-2026-24160-nvidia-trt-llm-null-pointer-dereference-causing-dos)