CVE-2026-65119

TensorRT-LLM tokenizer loading can include untrusted functionality

NVIDIA · TensorRT-LLM KvCacheAwareRouter

First documented disclosure · Review checkpoint

Summary

NVIDIA disclosed a tokenizer-loading trust-boundary flaw with potential code execution.

Severity and exploitation evidence

High · 8.4/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed primary sources document a vulnerability or controlled demonstration, not confirmed malicious exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The router can include functionality from an untrusted control sphere.

Conditions required

The vendor specifies a local attack vector; detailed deployment prerequisites are not published.

Potential impact

Potential code execution, information disclosure, data tampering and denial of service.

Affected versions and configurations

1.3.0rc24, all platforms, as listed by NVIDIA.

Fix and mitigation status

1.3.0rc25.

Practical next steps

Upgrade to the fixed vendor release and constrain tokenizer sources and execution privileges.

Operating lesson

Model-serving routers must independently control the code authority of tokenizer assets.

Evidence and limits

Initial bulletin and CVE publication October 27. Do not expand the affected range or claim a remote exploit beyond the vendor evidence.

Sources