ZDI-26-592: NVIDIA TensorRT ONNX File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability
NVIDIA TensorRT improper array index validation in ONNX parsing (CVE-2026-24238, CVSS 7.8) enables remote code execution.
ZDI-26-592 addresses improper validation of array index in NVIDIA TensorRT's ONNX file parsing, tracked as CVE-2026-24238 with CVSS 7.8. Exploitation permits remote code execution on affected installations and requires user interaction. The advisory was published by the Zero Day Initiative on August 24, 2026.
- Improper array index validation in ONNX parsing enables remote code execution
- Requires user interaction via malicious file or page
- Tracked as CVE-2026-24238, CVSS 7.8; patch available
- CVEs
- CVE-2026-24238
- Vendors
- NVIDIA
- Products
- TensorRT
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-24238 | NVIDIA TensorRT for contains a vulnerability where an attacker might cause an improper validation of array index | 7.8 | <1% |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA TensorRT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.