Executive brief
NVIDIA TensorRT, a high-performance deep learning inference library, contains a security flaw that could allow an attacker to execute malicious code on a target system. To exploit this, an attacker would typically need to convince a user to interact with a specially crafted file or application. If successful, this could lead to a complete compromise of the system, potentially resulting in data theft or unauthorized access to sensitive operations.
Technical details
A heap-based buffer overflow vulnerability (CWE-122) exists in NVIDIA TensorRT versions up to v10.16.1. The flaw is triggered when the library processes malformed data, leading to memory corruption. The attack vector is local (AV:L) and requires user interaction (UI:R), such as opening a malicious model or configuration file. A successful exploit allows for arbitrary code execution with the privileges of the application using the TensorRT library, potentially leading to full system compromise. NVIDIA has identified the affected version range as v0 through v10.16.1.
Affected products
- NVIDIA TensorRT v0 - v10.16.1
Timeline
- 2026-07-14: disclosed: Initial publication of CVE-2026-24268
- 2026-07-14: advisory