NVIDIA has unveiled and resolved a critical security flaw within its TensorRT-LLM framework, which could grant local attackers the ability to run malicious code, alter data, and jeopardize AI system integrity.
Identified as CVE-2025-23254, this vulnerability impacts all versions of TensorRT-LLM prior to 0.18.2, affecting platforms across Windows, Linux, and macOS.
The issue resides in the Python executor component, specifically in its Inter-Process Communication (IPC) mechanism that uses sockets. The flaw is linked to improper handling of Python’s pickle serialization, a method known for presenting security risks when dealing with untrusted data.
Rated with a CVSS base score of 8.8, this vulnerability is classified as high severity. It is associated with CWE-502 (Deserialization of Untrusted Data), a well-known security weakness that could allow attackers to execute remote code.
According to NVIDIA’s security advisory, “TensorRT-LLM for any supported platform contains a flaw in the Python executor that could enable attackers to bypass data validation if they have local access to the server.”
Exploiting this flaw could result in code execution, unauthorized data exposure, or even manipulation of information.
NVIDIA has acknowledged Avi Lumelsky of Oligo Security for responsibly disclosing the vulnerability.
| Risk Factors | Details |
|---|---|
| Affected Products | NVIDIA TensorRT-LLM (versions prior to 0.18.2 on Windows, Linux, and macOS) |
| Impact | Potential for code execution, data disclosure, and data manipulation |
| Exploit Prerequisites | Local access to TRTLLM server (AV:L), Low attack complexity (AC:L), Low user privileges (PR:L) |
| CVSS 3.1 Score | 8.8 (High) |
Technical Exploitation Path
This vulnerability is tied to Python’s pickle module, which allows arbitrary functions to be executed during deserialization through the __reduce__() method.
In the case of TensorRT-LLM, an attacker with local access to the server could create malicious serialized data. When the application deserializes this data, it would trigger the execution of arbitrary code with the privileges of the running process.
The ZeroMqQueue class within TensorRT-LLM’s IPC system was a key point of vulnerability, as it relied on the pickle module for serializing and deserializing data across processes, lacking sufficient validation measures.
Patch Deployment
On April 29, 2025, NVIDIA rolled out version 0.18.2, which introduces default HMAC (Hash-based Message Authentication Code) encryption to secure the socket-based IPC communication. This enhancement ensures that serialized data is validated for integrity before deserialization, preventing exploitation of the identified flaw.
NVIDIA strongly recommends that all users upgrade to version 0.18.2 or later to avoid potential security risks. The company also cautions that disabling the encryption feature will expose systems to the vulnerability.
For users unable to upgrade immediately, NVIDIA has provided an option to manually disable the encryption feature, though this is not recommended. In the main branch, users can set use_hmac_encryption = False in the ZeroMqQueue class under tensorrt_llm/executor/ipc.py. For release 0.18, the same change can be made in tensorrt_llm/executor.py.
This vulnerability underscores the increasing security concerns within AI frameworks, especially those managing complex operations for large-scale models.
Given TensorRT-LLM’s widespread use in accelerating generative AI models, particularly in production environments, organizations are urged to apply the patch promptly to safeguard their systems against potential attacks.
