First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-23254

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

NVIDIA TensorRT-LLM for any platform contains a vulnerability in python executor where an attacker may cause a data validation issue by local access to the TRTLLM server. A successful exploit of this vulnerability may lead to code execution, information disclosure and data tampering.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
NVIDIA	TensorRT-LLM	All versions prior to 0.18.2

References

https://nvidia.custhelp.com/app/answers/detail/a_id/5648

Timeline

Published: May 1, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-232553.3NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the cuobjdump binary where a user may cause an out-of-bounds read by passi CVE-2025-232568.7NVIDIA BlueField contains a vulnerability in the management interface, where an attacker with local access could cause incorrect authorizati CVE-2025-232577.3NVIDIA DOCA contains a vulnerability in the collectx-clxapidev Debian package that could allow an actor with low privileges to escalate priv CVE-2025-232587.3NVIDIA DOCA contains a vulnerability in the collectx-dpeserver Debian package for arm64 that could allow an attacker with low privileges to CVE-2025-232596.5NVIDIA Mellanox DPDK contains a vulnerability in Poll Mode Driver (PMD), where an attacker on a VM in the system might be able to cause info CVE-2025-232604.3NVIDIA AIStore contains a vulnerability in the AIS Operator where a user may gain elevated k8s cluster access by using the ServiceAccount at CVE-2025-232615.5NVIDIA Cumulus Linux and NVOS products contain a vulnerability, where hashed user passwords are not properly suppressed in log files, potent CVE-2025-232626.3NVIDIA ConnectX contains a vulnerability in the management interface, where an attacker with local access could cause incorrect authorizatio CVE-2025-232637.6NVIDIA DOCA-Host and Mellanox OFED contain a vulnerability in the VGT+ feature, where an attacker on a VM might cause escalation of privileg CVE-2025-232647.8NVIDIA Megatron-LM for all platforms contains a vulnerability in a python component where an attacker may cause a code injection issue by pr CVE-2025-232657.8NVIDIA Megatron-LM for all platforms contains a vulnerability in a python component where an attacker may cause a code injection issue by pr CVE-2025-232669.0NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could

CVE-2025-23254: High severity, CVSS 8.8 | Vulnix