NVIDIA TensorRT Vulnerable to Remote Code Execution via ONNX File Parsing Flaw
A critical vulnerability in NVIDIA TensorRT allows remote code execution through improper validation of array indices when parsing ONNX files.
NVIDIA TensorRT, a platform for high-performance deep learning inference, is facing a critical security vulnerability that could allow attackers to execute arbitrary code on affected systems. The flaw, identified as ZDI-26-592 and assigned CVE-2026-24238, stems from an improper validation of array indices during the parsing of ONNX (Open Neural Network Exchange) files.
The vulnerability specifically lies within the handling of Slice operations in ONNX models. When processing these operations, TensorRT fails to adequately validate user-supplied data. This oversight can lead to a buffer overflow, specifically a write past the end of an allocated array. Attackers can exploit this by crafting malicious ONNX files that, when parsed by a vulnerable instance of TensorRT, trigger this overflow condition.
Successful exploitation of this vulnerability requires user interaction. Attackers would need to trick a user into opening a malicious file or visiting a malicious web page that serves the crafted ONNX file. Once the file is processed, the attacker could potentially execute arbitrary code within the context of the current user's process, leading to a compromise of the affected system.
The Common Vulnerability Scoring System (CVSS) has assigned this vulnerability a score of 7.8, classifying it as High severity. This score reflects the potential impact of remote code execution, though the requirement for user interaction slightly mitigates the ease of exploitation compared to vulnerabilities that can be triggered remotely without any user involvement.
NVIDIA has acknowledged the vulnerability and has released a security update to address it. Users of NVIDIA TensorRT are strongly advised to apply the provided patches as soon as possible to protect their systems. Further details on the update can be found in NVIDIA's official advisory.
The disclosure timeline indicates that the vulnerability was initially reported to the vendor on April 15, 2026. Following coordinated disclosure efforts, the advisory was publicly released on August 24, 2026, with an update to the advisory also occurring on the same day. The research leading to the discovery of this flaw is credited to Seiji Sakurai, also known by the handle @HeapSmasher.
This vulnerability highlights a recurring theme in software security: the critical importance of robust input validation, especially when parsing complex file formats or data structures from potentially untrusted sources. Improper handling of array indices and buffer boundaries remains a common source of critical vulnerabilities across various software products, underscoring the need for continuous security auditing and patching.
As deep learning models and their associated frameworks become more integrated into critical infrastructure and applications, vulnerabilities like this in components like NVIDIA TensorRT pose a significant risk. Organizations relying on these technologies must remain vigilant in applying security updates and implementing defense-in-depth strategies to mitigate the impact of such threats.
This advisory provides further technical details on the NVIDIA TensorRT vulnerability, specifically highlighting that the flaw lies within the parsing of ONNX models. The issue stems from a lack of proper validation of user-supplied data length before copying it to a heap-based buffer, enabling attackers to execute code in the context of the current process. The Zero Day Initiative has assigned this vulnerability a CVSS score of 7.8 and credits Seiji Sakurai for its discovery.
The Zero Day Initiative advisory ZDI-26-591 provides further technical details on this NVIDIA TensorRT vulnerability, specifically detailing a heap-based buffer overflow within the ONNX file parsing component. This new information highlights that the flaw stems from insufficient validation of user-supplied data length before it is copied to a fixed-size buffer, potentially allowing for remote code execution in the context of the current process. The vulnerability has been assigned a CVSS score of 7.8 and was discovered by Seiji Sakurai.