NVIDIA TensorRT: ONNX Parsing Flaw Enables RCE with CVSS 7.8

On August 24, 2026, the Zero Day Initiative disclosed vulnerability ZDI-26-593, tracked as CVE-2026-24268, which enables remote arbitrary code execution through the parsing of malformed ONNX models in NVIDIA TensorRT. The bug, a heap-based buffer overflow caused by missing validation of user-supplied data length, requires minimal human interaction: simply opening a file or visiting a malicious web page suffices. Four months earlier, on April 15, the same flaw had been reported confidentially to NVIDIA, which released a fix.

The ONNX Parser as Attack Surface

The ONNX (Open Neural Network Exchange) format is the de facto standard for exchanging models across machine learning frameworks. TensorRT, NVIDIA's optimized inference runtime, ingests it to compile computational graphs into GPU-accelerated executables. According to the ZDI advisory, the flaw resides precisely in this parsing phase: "The specific flaw exists within the parsing of ONNX models. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer."

The bug's anatomy is classic memory corruption, but the context makes it insidious. No server compromise or API exposure is needed. An ONNX model — files that constantly circulate in AI environments across public repositories, commercial partners, and CI/CD pipelines — becomes the payload itself. The boundary between data and executable code dissolves the moment the runtime deserializes it without adequate size checks.

The CVSS 7.8 Risk Profile

The official CVE-2026-24268 record assigns the vulnerability a score of 7.8 out of 10, with vector CVSS:3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The combination reads clearly: local attack, low complexity, no prior privileges required, but user interaction necessary. Impact on confidentiality, integrity, and availability is high across all three dimensions.

The "UI:R" (User Interaction Required) element does not lower the danger: in the typical ML inference workflow, interaction is implicit. A data scientist downloads a model from Hugging Face and loads it into TensorRT. An MLOps engineer receives an artifact from a vendor and plugs it into a deployment pipeline. In both cases, "opening the malicious file" is a routine operation, not an anomalous event requiring elaborate social engineering.

"This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA TensorRT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file." — ZDI Advisory ZDI-26-593

Four Months of Coordinated Disclosure

The disclosure timeline reveals a respected responsible disclosure practice: reported to NVIDIA on April 15, 2026, coordinated publication on August 24, 2026. Zero Day Initiative does not publicly attribute the discovery to an identified researcher, a detail the dossier does not clarify. NVIDIA confirmed the release of a patch, but the ZDI advisory does not specify the exact version that includes it nor provide a direct URL to the vendor bulletin.

This operational gap matters: without a precise indication of the fixed version, administrators must independently verify through official NVIDIA channels which releases integrate the fix. The CVE record lists affected versions (v0 through v10.16.1 and v1.3.0 rc14) but not the patched ones. The discrepancy between the ZDI advisory's generality and the CVE record's granularity is a friction point for managing the patch cycle in production.

What to Do Now

Organizations using NVIDIA TensorRT for production ML model deployments must verify the presence of affected versions in their installed base: v0 through v10.16.1 and v1.3.0 rc14, per the official CVE record. The update released by NVIDIA should be applied as a priority on inference nodes that receive models from external sources or public repositories.

They should also inventory the flow of ONNX models in their internal supply chain: which repositories, partners, or pipelines introduce unverified artifacts directly into the TensorRT runtime. The attack surface is not the model itself, but the parser that ingests it; verification must therefore extend to the point of entry into the runtime, not just the file's origin.

For teams operating in environments with high intake of third-party models — model serving platforms, multi-tenant inference services, benchmarking pipelines — it is advisable to isolate ONNX loading in sandboxes or containers with minimal privileges, pending confirmation that vulnerable versions are absent. The dossier documents no public exploits or in-the-wild attacks, but the attack vector is realistic and exploitation complexity is low.

Finally, monitor the publication of additional technical details from NVIDIA: the absence of a specific patch URL in the ZDI advisory suggests vendor documentation may be supplemented in the coming hours or days. Direct verification of official NVIDIA bulletins remains the authoritative channel for confirming fixed versions.

The Invisible AI Supply Chain

CVE-2026-24268 illustrates a structural tension in contemporary AI infrastructure. Neural models are treated as data — files to download, share, version — but their parsing is code execution in every sense. The runtime that optimizes them for inference, TensorRT in this case, often operates with elevated privileges on expensive, sensitive hardware. A complex serialized format like ONNX, designed for interoperability, introduces an attack surface that MLOps pipelines don't always account for in their security controls.

The responsibility for protection does not rest solely with the runtime vendor, but on the understanding that the AI model supply chain is an execution supply chain. As long as this equivalence remains invisible, every public repository and every artifact transfer between teams represents a potential compromise point. NVIDIA's patch closes this specific instance; the risk category remains open.

Sources

• http://www.zerodayinitiative.com/advisories/ZDI-26-593/
• http://www.zerodayinitiative.com/advisories/published/
• https://www.cve.org/CVERecord?id=CVE-2026-24268
• http://www.zerodayinitiative.com/advisories/upcoming/
• https://www.trendmicro.com/
• https://www.trendmicro.com/en_us/business/products/one-platform.html

Information verified against cited sources and current as of publication.

Sources