CVE-2026-24268: NVIDIA TensorRT ONNX Parsing Heap Overflow — Detection and Remediation Guide for AI/ML Pipelines

The Zero Day Initiative has published ZDI-26-593, disclosing CVE-2026-24268 — a heap-based buffer overflow in NVIDIA TensorRT's ONNX file parsing logic that allows remote attackers to execute arbitrary code in the context of the target process. ZDI has assigned a CVSS score of 7.8 (High). Exploitation requires user interaction: the target must open a malicious ONNX model file or visit a page that causes one to be parsed. No authentication is required on the attacker's side — the only prerequisite is getting a crafted model artifact in front of a TensorRT-powered parsing path.

For defenders, this is not an abstract bug. TensorRT is the inference backbone for an enormous share of production AI/ML workloads — embedded in Triton Inference Server deployments, edge devices, autonomous systems, medical imaging pipelines, and custom applications that deserialize third-party .onnx models. AI supply chains routinely ingest models from public hubs like Hugging Face, internal registries, and vendor deliverables with minimal validation. That ingestion path is exactly what this vulnerability weaponizes.

If your organization runs TensorRT anywhere in its inference stack, treat this as a supply-chain-shaped code execution risk and act accordingly: inventory exposure, constrain model ingestion, and deploy the detections below while awaiting NVIDIA's patch guidance.

Technical Analysis

Affected Component

• Product: NVIDIA TensorRT (ONNX parser component)
• Vulnerability class: Heap-based buffer overflow (CWE-122)
• CVE: CVE-2026-24268
• Advisory: ZDI-26-593 — http://www.zerodayinitiative.com/advisories/ZDI-26-593/
• CVSS: 7.8 (High) — local attack vector per CVSS convention for file-parsing bugs, user interaction required, high impact to confidentiality, integrity, and availability

How the Vulnerability Works

TensorRT parses ONNX (Open Neural Network Exchange) model files — protobuf-serialized graphs describing model architecture, weights, and operators — to build optimized inference engines. The flaw exists in how the parser handles specific fields or structures within a crafted ONNX file: insufficient bounds validation during parsing allows attacker-controlled data to overflow a heap-allocated buffer.

From a defender's perspective, the attack chain looks like this:

1. Delivery: Attacker places a malicious .onnx file where a target will parse it — a model registry, a shared repository, a download link, an email attachment to an ML engineer, or a poisoned public model hub entry.
2. Trigger: The victim (or an automated pipeline stage) parses the file. Common triggers include trtexec, custom applications linking libnvinfer/nvinfer.dll, the ONNX parser API (nvonnxparser), Triton Inference Server loading a TensorRT plan/model repository, or CI/CD model-conversion jobs.
3. Corruption: The heap overflow corrupts adjacent memory structures. Skilled exploitation converts this into controlled writes and, ultimately, arbitrary code execution in the security context of the parsing process.
4. Post-exploitation: On a developer workstation, this yields user-context execution. On an inference server or CI runner, it may yield service-account or container-level execution — frequently with access to GPU resources, model IP, training data, and cloud credentials.

Exploitation Status

As of publication, this is a ZDI-coordinated disclosure. No public proof-of-concept or confirmed in-the-wild exploitation has been reported, and CVE-2026-24268 does not currently appear in the CISA Known Exploited Vulnerabilities catalog. However, ZDI advisories with fully documented parsing flaws historically attract rapid PoC development — file-parsing bugs in widely deployed libraries are a favorite of both researchers and exploit developers. The window between disclosure and weaponization for memory-corruption bugs in ML tooling should be assumed to be short.

Why This Is Worse Than a Typical 7.8

Two factors elevate real-world risk beyond the raw score:

• Automated parsing paths: While the advisory frames exploitation as requiring user interaction, production ML pipelines parse model files automatically — CI model validation, Triton model repository polling, and scheduled format-conversion jobs all parse ONNX without any human clicking anything. In those environments, the "user interaction" prerequisite evaporates.
• High-value execution context: Inference infrastructure often runs with elevated privileges, broad data access, and weak segmentation from the rest of the environment. A foothold on an inference server is a foothold on the data plane.

Detection & Response

The most reliable pre-patch detections focus on behavioral anomalies around TensorRT parsing processes: unexpected child processes, crashes in the parser, and suspicious ONNX file provenance. Signature-based detection on the malicious file itself is not viable until exploit samples surface.

Sigma Rules

---
title: TensorRT Process Spawning Unexpected Child Process
id: 3f9c1a72-6b84-4d2e-9f15-8a2c7d5e1034
status: experimental
description: Detects TensorRT engine tools or applications loading libnvinfer spawning shells, script interpreters, or downloaders — consistent with post-exploitation after successful CVE-2026-24268 ONNX parser exploitation.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-593/
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\trtexec.exe'
      - '\tritonserver.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\curl.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; legitimate TensorRT tooling does not spawn shells or downloaders
level: high
---
title: Suspicious ONNX Model File Written to Inference or Staging Paths
id: 8e2d4b61-3c95-47fa-a621-9d3f8e6b2045
status: experimental
description: Detects ONNX model files being written to model repositories, temp directories, or user-writable staging paths by non-pipeline processes. Crafted ONNX files are the delivery vehicle for CVE-2026-24268.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-593/
  - https://attack.mitre.org/techniques/T1195/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.t1195.002
  - attack.initial_access
logsource:
  category: file_event
  product: windows
detection:
  selection_ext:
    TargetFilename|endswith: '.onnx'
  selection_path:
    TargetFilename|contains:
      - '\Temp\'
      - '\AppData\Local\'
      - '\Downloads\'
      - '\Public\'
  filter_pipeline:
    Image|endswith:
      - '\python.exe'
      - '\git.exe'
  condition: selection_ext and selection_path and not filter_pipeline
falsepositives:
  - Data scientists manually downloading models from model hubs
level: medium
---
title: TensorRT or Triton Server Process Crash Indicating Parser Exploitation Attempt
id: 5b7e2f94-1a63-4c8d-b542-7c1a9f3d5076
status: experimental
description: Detects application error events for TensorRT-related binaries. Heap corruption during ONNX parsing frequently crashes the process when exploitation fails — repeated crashes can indicate exploit attempts against CVE-2026-24268.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-593/
  - https://attack.mitre.org/techniques/T1499/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1499
logsource:
  category: application
  product: windows
detection:
  selection:
    EventID: 1000
    Message|contains:
      - 'trtexec.exe'
      - 'nvinfer.dll'
      - 'nvonnxparser.dll'
      - 'tritonserver.exe'
falsepositives:
  - Legitimate crashes from malformed models during development; correlate with file provenance
level: medium

KQL — Microsoft Sentinel / Defender

This query hunts for TensorRT and Triton processes exhibiting post-exploitation behavior (spawning interpreters, shells, or egress tooling) and correlates with recent ONNX file drops on the same device.

let TensorRTProcs = dynamic(["trtexec.exe", "tritonserver.exe", "tensorrt", "tritonserver"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "sh", "bash", "curl.exe", "curl", "wget", "certutil.exe", "mshta.exe", "rundll32.exe", "python.exe", "python"]);
let SuspiciousSpawns =
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessFileName in~ (TensorRTProcs)
    | where FileName in~ (SuspiciousChildren)
    | project SpawnTime=TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessId;
let RecentOnnx =
    DeviceFileEvents
    | where TimeGenerated > ago(14d)
    | where FileName endswith ".onnx"
    | where ActionType == "FileCreated"
    | project OnnxTime=TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName as Dropper;
SuspiciousSpawns
| join kind=leftouter RecentOnnx on DeviceName
| where isempty(OnnxTime) or OnnxTime between (SpawnTime .. SpawnTime + 1h)
| project SpawnTime, DeviceName, InitiatingProcessFileName, ProcessCommandLine, AccountName, OnnxTime, FileName, FolderPath, Dropper
| sort by SpawnTime desc

For Linux inference hosts forwarding Syslog/CEF into Sentinel, hunt parser crashes and unexpected execve activity from TensorRT-linked services:

Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("nvinfer", "nvonnxparser", "trtexec", "tritonserver")
| where SyslogMessage has_any ("segfault", "SIGSEGV", "heap", "corrupt", "core dumped", "aborted")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| sort by TimeGenerated desc

Velociraptor VQL

Hunt endpoints and inference servers for TensorRT-linked processes with anomalous children, and enumerate recently created ONNX files outside sanctioned model directories.

-- Hunt: TensorRT processes with suspicious children + recent ONNX artifacts
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(cmd|powershell|pwsh|sh|bash|curl|wget|mshta|rundll32)'
  AND Ppid IN (
    SELECT Pid FROM pslist()
    WHERE Name =~ '(?i)(trtexec|tritonserver|tensorrt)'
       OR CommandLine =~ '(?i)(nvinfer|nvonnxparser|tensorrt)'
  )

-- Hunt: Recently created ONNX files in non-standard locations (last 14 days)
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=['C:/Users/*/Downloads/*.onnx', 'C:/Users/*/AppData/Local/Temp/**/*.onnx', '/tmp/*.onnx', '/home/*/Downloads/*.onnx'])
WHERE Mtime > now() - 1209600
ORDER BY Mtime DESC

Remediation & Verification Script

Inventory TensorRT exposure across Windows hosts, flag ONNX parser presence, and enumerate recently modified model artifacts pending investigation. Run elevated on inference servers and ML engineering workstations.

# CVE-2026-24268 — TensorRT ONNX Parser Exposure Inventory
# Identifies TensorRT installations, parser DLLs, and recent .onnx artifacts

$report = @()

# 1. Locate TensorRT runtime and ONNX parser components
$searchRoots = @("$env:ProgramFiles", "${env:ProgramFiles(x86)}", "$env:LOCALAPPDATA", "C:\opt", "C:\tensorrt")
foreach ($root in $searchRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Include "nvinfer.dll","nvonnxparser.dll","trtexec.exe","tritonserver.exe" -ErrorAction SilentlyContinue |
            ForEach-Object {
                $report += [PSCustomObject]@{
                    Component = $_.Name
                    Path      = $_.FullName
                    Version   = $_.VersionInfo.FileVersion
                    Modified  = $_.LastWriteTime
                }
            }
    }
}

# 2. Check Python environments for tensorrt packages
$pipPaths = Get-Command pip, pip3 -ErrorAction SilentlyContinue
foreach ($p in $pipPaths) {
    $pkgs = & $p.Source list 2>$null | Select-String -Pattern "tensorrt"
    if ($pkgs) { $report += [PSCustomObject]@{ Component="PythonPackage"; Path=$pkgs.Line; Version=""; Modified="" } }
}

# 3. Enumerate ONNX files modified in the last 14 days in user-writable locations
$recentOnnx = Get-ChildItem -Path "$env:TEMP","$env:USERPROFILE\Downloads","C:\Users\Public" -Recurse -Filter "*.onnx" -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
    Select-Object FullName, Length, LastWriteTime

Write-Host "=== TensorRT Component Inventory ===" -ForegroundColor Cyan
$report | Format-Table -AutoSize
Write-Host "=== Recent .onnx Artifacts (14 days) — review provenance before parsing ===" -ForegroundColor Cyan
$recentOnnx | Format-Table -AutoSize

$report | Export-Csv -Path "tensorrt_inventory_$(hostname)_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
Write-Host "Export complete. Cross-reference versions against NVIDIA PSIRT guidance for CVE-2026-24268." -ForegroundColor Yellow

Remediation

1. Apply NVIDIA's fix immediately upon release. Monitor the NVIDIA security bulletin associated with CVE-2026-24268 via NVIDIA Product Security and your GPU driver/CUDA update channels. Do not wait for your standard patch cadence — memory-corruption bugs in file parsers are prime PoC targets, and the ZDI advisory gives exploit developers a head start.
2. Constrain ONNX ingestion paths until patched. Block or quarantine .onnx files arriving via email, web upload, and unmanaged model hub downloads. Route all model acquisition through a vetted internal registry with manual review for new artifacts.
3. Sandbox model parsing. Perform all untrusted ONNX parsing — validation, conversion, trtexec runs, CI checks — inside ephemeral, unprivileged containers with no network egress, no mounted credentials, and no access to production model stores. If the parser is exploited, the blast radius is a disposable container.
4. Isolate inference infrastructure. Segment Triton/TensorRT servers away from general workstation and user networks. Apply strict egress filtering — an inference server has no business initiating outbound connections to arbitrary internet hosts.
5. Enforce model provenance. Require signed or hash-pinned models from trusted sources. Treat any model whose origin cannot be verified as hostile until inspected in the sandbox above.
6. Reduce privilege of parsing processes. Run inference services and CI conversion jobs under dedicated least-privilege service accounts. On Linux, drop capabilities and apply seccomp/AppArmor profiles; in containers, avoid --privileged and read-only root filesystems where feasible.
7. Deploy the detections above and alert on TensorRT-linked process crashes, unexpected child processes, and unsanctioned ONNX drops. A crash loop in a parser process is an exploitation attempt until proven otherwise.
8. Audit ML pipeline automation. Identify every automated job that parses ONNX files — these paths bypass the "user interaction" prerequisite and represent your highest-risk exposure. Temporarily disable auto-ingestion from external sources where operationally tolerable.

Key Takeaways

• CVE-2026-24268 is a heap-based buffer overflow in TensorRT's ONNX parser (CVSS 7.8, ZDI-26-593) enabling unauthenticated code execution when a crafted model file is parsed.
• No public exploitation is confirmed yet, but file-parsing memory-corruption bugs in ubiquitous libraries are rapidly weaponized — patch on NVIDIA's release, not on your normal cycle.
• Automated ML pipelines that parse models without human interaction are the real attack surface; the "user interaction required" caveat is misleading in production environments.
• Until patched, sandbox all untrusted model parsing, constrain ONNX ingestion, segment inference infrastructure, and deploy behavioral detections around TensorRT processes.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub