CVE-2026-24233

{
  "id": "CVE-2026-24233",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-14T21:16:44.187",
  "lastModified": "2026-10-24T21:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model weight deserialization, where a local, unauthenticated attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure."
    },
    {
      "lang": "es",
      "value": "NVIDIA TensorRT-LLM para Linux contiene una vulnerabilidad en el unpickler restringido utilizado para la deserialización de pesos de modelo, donde un atacante local no autenticado podría causar la deserialización de datos no confiables. Un exploit exitoso de esta vulnerabilidad podría conducir a la ejecución de código, escalada de privilegios, manipulación de datos y revelación de información."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "NVIDIA",
          "product": "TensorRT-LLM",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0.0",
              "lessThanOrEqual": "v1.3.0 rc14",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.4,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-15T14:15:05.508809Z",
          "id": "CVE-2026-24233",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24233",
      "source": "[email protected]"
    },
    {
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24233",
      "source": "[email protected]"
    }
  ]
}