# CVE-2026-24160: NVIDIA TRT-LLM null pointer dereference causing DoS

Source: https://junglewise.ai/threats/cve-2026-24160-nvidia-trt-llm-null-pointer-dereference-causing-dos  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-20. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

CVE-2026-24160 · Severity: medium · CVSS 5.5 · Published 2026-05-20

NVIDIA TRT-LLM, a library used to accelerate and optimize Large Language Model (LLM) performance, contains a software flaw. An attacker could exploit this issue to cause the software to crash, leading to a denial of service. This could disrupt AI-driven operations and services that rely on this library for processing.

Technologies: [Nvidia TRT-LLM](https://junglewise.ai/threats/technologies/trt-llm). Vendors: [Nvidia](https://junglewise.ai/threats/vendors/nvidia).

## Quick answers

**Is CVE-2026-24160 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-24160 being exploited in the wild.

**How severe is CVE-2026-24160?** Medium severity, with a CVSS score of 5.5, published 20 May 2026.

**Which products and versions are affected?** Nvidia TRT-LLM All platforms.

**Is there a fix for CVE-2026-24160?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-24160 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-24160?** Check whether you run Nvidia TRT-LLM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in NVIDIA TRT-LLM (all platforms) classified as CWE-690 (Unchecked Return Value to NULL Pointer Dereference). The issue occurs when the software fails to verify the return value of a function before using it as a pointer, which can lead to a null pointer dereference. This is a local attack vector requiring user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R). A successful exploit allows an attacker to trigger a crash of the application, resulting in a denial of service (DoS). No impact on confidentiality or integrity was reported.

## Affected products

- NVIDIA TRT-LLM All platforms

## Timeline

- 2026-05-20: disclosed: Initial publication of CVE-2026-24160

## References

- [https://nvidia.custhelp.com/app/answers/detail/a_id/5805](https://nvidia.custhelp.com/app/answers/detail/a_id/5805)
- [https://www.cve.org/CVERecord?id=CVE-2026-24160](https://www.cve.org/CVERecord?id=CVE-2026-24160)

## Related threats

- [NVIDIA TRT-LLM unsafe deserialization in RPC testing](https://junglewise.ai/threats/cve-2026-24163-nvidia-trt-llm-unsafe-deserialization-in-rpc-testing)
- [NVIDIA TRT-LLM unsafe deserialization in MPI server](https://junglewise.ai/threats/cve-2025-33255-nvidia-trt-llm-unsafe-deserialization-in-mpi-server)