Loading story…
NVIDIA disclosed CVE-2026-24233, a high-severity vulnerability in TensorRT-LLM for Linux caused by insecure deserialization in the product’s restricted unpickler for model weight loading. The flaw affects versions up to and including v1.3.0 rc14 and allows a local, unauthenticated attacker to trigger deserialization of untrusted data, potentially leading to remote code execution, privilege escalation, data tampering, and information disclosure. The issue carries a CVSS v3.1 score of 8.4 with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
The vulnerability is classified as CWE-502: Deserialization of Untrusted Data, a weakness that arises when software processes attacker-controlled serialized input without sufficient validation. MITRE notes that such flaws can let attackers abuse gadget chains or unsafe object handling to alter program state, cause denial of service, or execute arbitrary code, and recommends mitigations including integrity protection for serialized data, strict allowlisting of acceptable classes, reducing available gadget types, and defensive coding patterns that block unsafe deserialization paths.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
On 2026-07-14, a CVE record was published for CVE-2026-24233, a high-severity insecure deserialization vulnerability in NVIDIA TensorRT-LLM for Linux. The flaw affects versions up to and including v1.3.0 rc14 and could allow local unauthenticated code execution, privilege escalation, data tampering, and information disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecve.org
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple high-severity deserialization vulnerabilities have been identified in widely used AI and analytics frameworks, including NVIDIA Isaac Lab, MooreThreads torch_musa, and NVIDIA Merlin components. These flaws allow attackers to exploit unsafe deserialization processes, potentially leading to remote code execution or denial-of-service conditions on affected systems. In the case of MooreThreads torch_musa, the vulnerability arises from the use of `pickle.load()` on user-controlled files without validation, enabling arbitrary code execution with the privileges of the victim process. Similarly, NVIDIA Isaac Lab and Merlin frameworks are affected by deserialization issues that could be exploited remotely, with Merlin's NVTabular and Transformers4Rec components specifically highlighted for their susceptibility to code execution and data tampering attacks. Security advisories urge immediate patching, as these vulnerabilities are remotely exploitable and pose significant risks to enterprise environments. The affected products span various versions, and organizations using these frameworks are advised to review vendor guidance and apply available security updates to mitigate the threat. The vulnerabilities have been assigned high or critical CVSS scores, underscoring the urgency for remediation to prevent potential exploitation in production environments.
Jun 29, 2026
NVIDIA issued security updates for multiple products across its AI and enterprise software stack, fixing vulnerabilities that could allow **remote code execution**, denial of service, privilege escalation, data tampering, and information disclosure. The most severe issue disclosed in its broader March advisories was `CVE-2025-33244` in **NVIDIA Apex**, a widely used PyTorch extension for mixed-precision and distributed training. High-severity flaws were also addressed in **Triton Inference Server**, **Megatron LM**, **NeMo Framework**, and **Model Optimizer**, with NVIDIA warning that exploitation could disrupt AI workloads, expose sensitive training data, or enable unauthorized access. Medium-severity issues were additionally listed in **VIRTIO-Net**, **SNAP4**, and **B300 MCU**. NVIDIA later released urgent fixes for **TensorRT-LLM** and **Isaac Launchable**, including TensorRT-LLM deserialization flaws in MPI server and RPC testing components that could lead to RCE, data manipulation, information disclosure, or service outages. It also patched a Linux issue in Isaac Launchable involving sensitive information sent in clear text, creating risks of privilege escalation and system disruption. NVIDIA advised customers to upgrade **TensorRT-LLM** to `1.2.1` or later, and said organizations running multi-GPU deployments should use: ```bash trtllm-llmapi-launch ``` to reduce network exposure. The company has also begun publishing PSIRT bulletins on GitHub in Markdown and CSAF formats to support automated vulnerability management and faster remediation.
Jun 29, 2026
A critical remote code execution (RCE) vulnerability, tracked as CVE-2025-49655, has been identified in the Keras machine learning framework, specifically affecting versions 3.11.0 up to but not including 3.11.3. The flaw arises from unsafe deserialization of untrusted data within the TorchModuleWrapper class, which can be exploited when a maliciously crafted Keras file is loaded. This vulnerability allows attackers to execute arbitrary code on the victim's system, even if Keras is running in safe mode, significantly increasing the risk profile for users who routinely load external or shared model files. The issue can be triggered through both local and remote files, making it exploitable in a variety of deployment scenarios, including cloud-based and on-premises environments. The vulnerability has been assigned a CVSS v3.1 base score of 9.8, categorizing it as critical due to the ease of exploitation and the potential impact. Security researchers have highlighted that the attack does not require authentication, and exploitation can occur simply by loading a malicious model file. The vulnerability was publicly disclosed in October 2025, with security advisories urging immediate action. At the time of disclosure, the affected product versions were clearly identified, but some databases had not yet listed all impacted vendors or products. The Keras development team has released a patch in version 3.11.3 to address the issue, and users are strongly advised to upgrade to this version or later. Organizations using Keras in production or research environments should audit their model loading workflows and restrict the use of untrusted model files. The vulnerability underscores the broader risks associated with deserialization flaws in machine learning frameworks, which are increasingly targeted due to their widespread adoption. Security teams are encouraged to monitor for suspicious activity related to model file handling and to implement additional controls where feasible. The incident has prompted renewed calls for secure coding practices and rigorous input validation in AI and machine learning software. The rapid response from the Keras maintainers has been noted, but the incident serves as a warning for similar frameworks to review their own deserialization logic. The vulnerability's critical rating reflects both the technical severity and the potential for widespread exploitation if left unaddressed. Industry experts recommend that all organizations using Keras review their current deployments and apply the necessary updates without delay. The disclosure of CVE-2025-49655 has also led to increased scrutiny of third-party model sharing platforms, which may inadvertently distribute malicious files. This event highlights the importance of maintaining up-to-date software and following best practices for secure machine learning operations.
Jun 29, 2026