# CVE-2026-24272: NVIDIA TensorRT heap buffer overflow

Source: https://junglewise.ai/threats/cve-2026-24272-nvidia-tensorrt-heap-buffer-overflow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-24272 · Severity: high · CVSS 7.8 · Published 2026-07-14

NVIDIA TensorRT, a high-performance deep learning inference library, is affected by a memory handling vulnerability. An attacker could exploit this flaw to execute unauthorized code on a target system. This could lead to a complete compromise of the system's confidentiality, integrity, and availability, potentially impacting AI model processing and sensitive data.

Technologies: [Nvidia TensorRT](https://junglewise.ai/threats/technologies/tensorrt). Vendors: [Nvidia](https://junglewise.ai/threats/vendors/nvidia).

## Quick answers

**Is CVE-2026-24272 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-24272 being exploited in the wild.

**How severe is CVE-2026-24272?** High severity, with a CVSS score of 7.8, published 14 July 2026.

**Which products and versions are affected?** Nvidia TensorRT v0 - v10.16.1.

**Is there a fix for CVE-2026-24272?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-24272 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-24272?** Check whether you run Nvidia TensorRT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

NVIDIA TensorRT is vulnerable to a heap-based buffer overflow (CWE-122). The vulnerability exists in versions up to v10.16.1. An attacker can exploit this by providing specially crafted input that triggers an overflow in the heap memory region. While the attack vector is local, it requires no special privileges, though it does necessitate user interaction (UI:R). Successful exploitation can lead to arbitrary code execution with the privileges of the application using the TensorRT library. NVIDIA has released information regarding this vulnerability in advisory A_ID 5855.

## Affected products

- NVIDIA TensorRT v0 - v10.16.1

## Timeline

- 2026-07-14: disclosed
- 2026-07-14: advisory

## References

- [https://nvidia.custhelp.com/app/answers/detail/a_id/5855](https://nvidia.custhelp.com/app/answers/detail/a_id/5855)
- [https://www.cve.org/CVERecord?id=CVE-2026-24272](https://www.cve.org/CVERecord?id=CVE-2026-24272)

## Related threats

- [NVIDIA TensorRT out-of-bounds read](https://junglewise.ai/threats/cve-2026-65122-nvidia-tensorrt-contains-a-vulnerability-where-an-attacker-can)
- [NVIDIA TensorRT heap buffer overflow](https://junglewise.ai/threats/cve-2026-24268-nvidia-tensorrt-heap-buffer-overflow)
- [NVIDIA TensorRT improper validation of array index](https://junglewise.ai/threats/cve-2026-24238-nvidia-tensorrt-improper-validation-of-array-index)
- [NVIDIA TensorRT deserialization of untrusted data](https://junglewise.ai/threats/cve-2026-24227-nvidia-tensorrt-deserialization-of-untrusted-data)
- [NVIDIA TensorRT out-of-bounds write](https://junglewise.ai/threats/cve-2026-24188-nvidia-tensorrt-out-of-bounds-write)