A vulnerability in NVIDIA TensorRT-LLM allows for unsafe deserialization of untrusted data, potentially leading to total system compromise by a high-privileged attacker.

This vulnerability (CWE-502) involves unsafe deserialization of untrusted data within the RPC testing component. The CVSS vector (PR:H) indicates that successful exploitation requires an attacker to possess high privileges.

The potential for unsafe deserialization poses a severe risk, as it may allow an attacker to achieve code execution or perform unauthorized operations on the host system. While the CVSS score of 7.5 reflects a high severity, the technical impact is categorized as total, warranting immediate attention to protect the integrity and availability of AI/ML infrastructure.

Immediate Action: Update NVIDIA TensorRT-LLM to version 1.2 or later to resolve the deserialization vulnerability.

Proactive Monitoring: Monitor RPC service logs for abnormal deserialization requests or unexpected process spawning originating from the testing service.

Compensating Controls: Ensure that access to RPC testing interfaces is strictly restricted to authorized administrative accounts and network segments, minimizing the attack surface.

Public Exploit Available: false

Given the potential for total system impact, administrators should prioritize updating TensorRT-LLM to version 1.2 or later. Organizations utilizing these libraries in production environments should ensure that testing components are not exposed to untrusted network segments.