CVE-2026-47475: reachable assertion crashes sampler

CISO Take

NVIDIA's TensorRT-LLM ships a reachable assertion (CWE-617) in the sampler thread of its OpenAI-compatible inference API, where a specially crafted request can trip an internal assertion and crash the serving process — a straightforward denial-of-service, not a data-exposure or code-execution issue. The CVSS v3.1 score of 6.2 reflects low attack complexity and no privileges or user interaction required, but the confidentiality and integrity impact are both none; this is purely availability risk against self-hosted GPU inference endpoints. There's no EPSS score, no CISA KEV listing, no public exploit, and no Nuclei template for this CVE, so exploitation-in-the-wild signal is currently absent — treat it as plausible-but-unconfirmed rather than urgent. Any team running TensorRT-LLM as an inference backend (directly or behind a gateway) should check NVIDIA's advisory for a patched release, and in the meantime add process-level restart/health-check monitoring on the sampler thread and rate-limit or validate sampling parameters at the API gateway to blunt malformed-request crashes.

Sources: NVD ATLAS

What is the risk?

Medium severity, availability-only impact. Low attack complexity and no authentication required mean any party who can reach the OpenAI-compatible endpoint can attempt exploitation, but the effect is limited to a service crash/restart rather than data compromise or lateral movement. The local attack vector (AV:L) narrows real-world exposure to hosts/networks where the API is reachable, which for many production deployments still includes internal users, other services, or — if the endpoint is internet-facing — external attackers. Absence of EPSS data, KEV listing, or public PoC lowers near-term urgency, but reachable-assertion bugs are typically trivial to weaponize once the crashing input is known.

How does the attack unfold?

Initial Access

Attacker obtains network reachability to the TensorRT-LLM OpenAI-compatible inference API.

AML.T0040

Exploitation

Attacker sends a request with crafted sampling parameters designed to violate an internal assertion in the sampler thread.

AML.T0049

Impact

The assertion fires and crashes the sampler thread, denying inference service to all clients of that deployment.

AML.T0029

Initial Access

Attacker obtains network reachability to the TensorRT-LLM OpenAI-compatible inference API.

AML.T0040

Exploitation

Attacker sends a request with crafted sampling parameters designed to violate an internal assertion in the sampler thread.

AML.T0049

Impact

The assertion fires and crashes the sampler thread, denying inference service to all clients of that deployment.

AML.T0029

How severe is it?

CVSS 3.1

6.2 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 6% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC Low

PR None

UI None

S Unchanged

C None

I None

A High

What should I do?

1 step

Track NVIDIA's advisory for CVE-2026-47475 and apply the patched TensorRT-LLM release as soon as it's available. Until patched, restrict network reachability of the OpenAI-compatible API to trusted callers only (avoid direct internet exposure), and validate/bound sampling parameters (top_k, top_p, logit_bias, etc.) at an API gateway or proxy in front of TensorRT-LLM before they reach the sampler. Add process supervision (auto-restart) and alerting on unexpected sampler-thread crashes so an outage is detected and recovered from quickly, and monitor for repeated crash patterns that could indicate active probing.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Inference API AML.T0029 - Denial of AI Service AML.T0040 - AI Model Inference API Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

OWASP LLM Top 10

LLM10:2025 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-47475?

NVIDIA's TensorRT-LLM ships a reachable assertion (CWE-617) in the sampler thread of its OpenAI-compatible inference API, where a specially crafted request can trip an internal assertion and crash the serving process — a straightforward denial-of-service, not a data-exposure or code-execution issue. The CVSS v3.1 score of 6.2 reflects low attack complexity and no privileges or user interaction required, but the confidentiality and integrity impact are both none; this is purely availability risk against self-hosted GPU inference endpoints. There's no EPSS score, no CISA KEV listing, no public exploit, and no Nuclei template for this CVE, so exploitation-in-the-wild signal is currently absent — treat it as plausible-but-unconfirmed rather than urgent. Any team running TensorRT-LLM as an inference backend (directly or behind a gateway) should check NVIDIA's advisory for a patched release, and in the meantime add process-level restart/health-check monitoring on the sampler thread and rate-limit or validate sampling parameters at the API gateway to blunt malformed-request crashes.

Is CVE-2026-47475 actively exploited?

No confirmed active exploitation of CVE-2026-47475 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-47475?

Track NVIDIA's advisory for CVE-2026-47475 and apply the patched TensorRT-LLM release as soon as it's available. Until patched, restrict network reachability of the OpenAI-compatible API to trusted callers only (avoid direct internet exposure), and validate/bound sampling parameters (top_k, top_p, logit_bias, etc.) at an API gateway or proxy in front of TensorRT-LLM before they reach the sampler. Add process supervision (auto-restart) and alerting on unexpected sampler-thread crashes so an outage is detected and recovered from quickly, and monitor for repeated crash patterns that could indicate active probing.

What systems are affected by CVE-2026-47475?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference.

What is the CVSS score for CVE-2026-47475?

CVE-2026-47475 has a CVSS v3.1 base score of 6.2 (MEDIUM). The EPSS exploitation probability is 0.16%.

What is the AI security impact?

Affected AI Architectures

model servingLLM inference

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0040 AI Model Inference API Access

Compliance Controls Affected

EU AI Act: Article 15

OWASP LLM Top 10: LLM10:2025

What are the technical details?

Original Advisory

NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API where an attacker could trigger a reachable assertion in the sampler thread. A successful exploit of this vulnerability might lead to denial of service.

Exploitation Scenario

An attacker with network access to a TensorRT-LLM-backed OpenAI-compatible endpoint sends a completion or chat request with a crafted combination of sampling parameters designed to violate an internal invariant checked by an assertion in the sampler thread. The assertion fires, crashing the thread (and likely the serving process), which denies inference service to all users of that deployment until it's restarted — repeatable at will to sustain an outage against the application or product relying on that inference backend.

Weaknesses (CWE)

CWE-617 Reachable Assertion Primary CWE-617 Reachable Assertion

CWE-617 — Reachable Assertion: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

[Implementation] Make sensitive open/close operation non reachable by directly user-controlled data (e.g. open/close resources)
[Implementation] Perform input validation on user data.

Source: MITRE CWE corpus.