NVIDIA TensorRT-LLM: untrusted tokenizer loading in KvCacheAwareRouter can execute code

CVSS 8.4CVE-2026-65119AI/ML frameworks & servingcurated

Impact

TensorRT-LLM's KvCacheAwareRouter loads a tokenizer from a location an attacker can influence, pulling in functionality from an untrusted control sphere. NVIDIA states a successful exploit may lead to code execution, information disclosure, data tampering and denial of service. On a GPU serving fleet this means the inference process - which holds the GPU, the loaded weights and whatever credentials the serving pod carries - can be made to run attacker code. The CVSS vector is local (AV:L) with no privileges required, so the realistic path is a tenant or pipeline that controls the model or tokenizer artifacts the router is pointed at.

Who can reach it

Local to the serving host or control over the tokenizer/model artifact that TensorRT-LLM loads. No authentication required per the CVSS vector (PR:N); user interaction not required.

What to do

Upgrade TensorRT-LLM to the fixed version listed in NVIDIA bulletin 5883 and restart the inference servers. This is a userspace serving component, so a rolling restart of the serving deployment is enough - no node reboot or firmware work. Until then, treat tokenizer and model artifact paths as privileged and restrict who can write them.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-65119 https://github.com/NVIDIA/product-security/tree/main/2026/5883 https://www.cve.org/CVERecord?id=CVE-2026-65119

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.