NVIDIA TensorRT-LLM: Inclusion of untrusted functionality via tokenizer loading
Summary
NVIDIA TensorRT-LLM contains a flaw in tokenizer loading in KvCacheAwareRouter that allows functionality from an untrusted control sphere to be included (CWE-829). According to the CNA, a successful exploit may lead to code execution, information disclosure, data tampering and denial of service. The CNA rates the attack vector as local, with no privileges or user interaction required. Only version 1.3.0rc24 is listed as affected, and no fixed version is confirmed.
Affected
- NVIDIA TensorRT-LLM 1.3.0rc24 (per CNA record; default: unaffected)
- Other versions: Unknown.
Fixed in
Unknown. Check NVIDIA security bulletin 5883 for the fixed version.
Workaround
No vendor-confirmed workaround.
- Load tokenizers and model artifacts only from trusted internal or verified sources and pin them by hash.
- Restrict who can set model or tokenizer paths and which directories the service reads from.
- Run the inference service with least privilege and keep it off untrusted networks.
Exploitation
- Not known to be exploited in the wild (per OffSeq).
- Not listed in CISA KEV (per Strix).
- No public exploit found; VulDB states there is no available exploit.
Our recommendation
- Check whether TensorRT-LLM is in use and confirm the installed version.
- If version 1.3.0rc24 is in use, apply the workarounds above and upgrade once NVIDIA publishes a fixed build.
- Restrict local access to model directories and monitor them for unexpected changes.
- If TensorRT-LLM is not used, no action is needed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- NVIDIA Security Bulletin 5883 (GitHub) github.com
- NVD: CVE-2026-65119 nvd.nist.gov
- CVE Record: CVE-2026-65119 www.cve.org
- VulDB: CVE-2026-65119 vuldb.com
- OffSeq Radar: CVE-2026-65119 radar.offseq.com
- Strix: CVE-2026-65119 www.strix.ai
- ThreatInt: CVE-2026-65119 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:57.
Original description (NVD)
NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusion of functionality from an untrusted control sphere. A successful exploit might lead to code execution, information disclosure, data tampering, and denial of service.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.