{"resourceId":"nvidia-security-bulletin-5903-model-optimizer-cve-2026-65142-20261006","versions":[{"version":"external-f0dc9e170748189aed0383944336a91c975e6ec8f50eff00e442686709dae1f8","resource":{"id":"nvidia-security-bulletin-5903-model-optimizer-cve-2026-65142-20261006","title":"NVIDIA bulletin 5903: Model-Optimizer unsafe deserialization (CVE-2026-65142, CVSS 7.8 High), fixed in 0.44.0; first GitHub-only bulletins also include TensorRT 5891","organization":"NVIDIA PSIRT","sector":"Technology vendor (product security)","geography":"Global","publishedAt":"2026-10-06","publicationDate":"2026-10-06","eventDate":"2026-10-06","sourceName":"GitHub — NVIDIA/product-security","sourceLabel":"Vendor security bulletin","sourceUrl":"https://github.com/NVIDIA/product-security/blob/main/2026/5903/5903.md","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["data-security","developers-agents","infrastructure"],"finding":"Bulletin 5903 (Oct 6, 2026) reports CVE-2026-65142 in NVIDIA Model-Optimizer: an attacker may cause deserialization of untrusted data, possibly leading to code execution, data tampering, denial of service and information disclosure. CVSS 3.1 base score 7.8 (High), vector AV:L/AC:L/PR:N/UI:R; affected versions 0 through 0.43.0, fixed in 0.44.0; found externally. The same day, bulletin 5891 reported CVE-2026-65122 in TensorRT, an out-of-bounds read leading to denial of service, CVSS 5.5 (Medium), affecting versions 0 to 11.1, fixed in 11.2. These are the first two bulletins dated after the Oct 1 GitHub-only change.","sledRelevance":"University research groups and agency AI teams that quantize or optimize models with Model-Optimizer, or build inference engines with TensorRT, often install these from GitHub or pip outside central patch tools. Loading an untrusted model or checkpoint is the likely exposure path for the deserialization flaw (interpretation).","evidence":"Fetched the Markdown versions of bulletins 5903 and 5891 from the repository and read them in full, including affected and fixed versions.","architectureImplications":"Developer and research environments need software inventories that include Python packages and SDKs, not just drivers.","governanceImplications":"Model and checkpoint intake rules (trusted sources only) reduce exposure to deserialization flaws.","securityPrivacyImplications":"High-severity code-execution risk requires user interaction (UI:R) and local access per the vector; update to 0.44.0 and avoid loading untrusted artifacts.","caveats":"Vendor bulletin; no exploitation details or known-exploited status given. Exposure path is our interpretation.","streamIds":["nvidia"],"roles":{"sales":"These first GitHub-only bulletins hit AI developer tools rather than drivers: a High-severity Model-Optimizer flaw and a Medium TensorRT flaw. That is a useful prompt with research and agency AI teams, whose Python packages often sit outside central patching. We can offer to inventory NVIDIA AI software across labs and pipelines. We should not claim active exploitation; the bulletin gives none, and the flaw needs local access and user interaction.","engineering":"Engineering response: find Model-Optimizer installs below 0.44.0 and TensorRT below 11.2 across containers, notebooks and CI images, and update. Prerequisites are a package inventory or SBOM for AI environments. Constraint: researchers may pin versions for reproducibility. Security: restrict loading of untrusted checkpoints. Proof of value: scan images and environments for affected versions and confirm none remain after patching.","delivery":"Delivery work is a targeted patch campaign for AI developer environments plus a rule that models and checkpoints come only from approved sources. The research computing security lead owns it with lab managers. Checkpoints are the inventory scan, patch completion and image rebuild. Proposed acceptance criterion: no affected versions in managed images within 30 days. Risks are unmanaged laptops and pinned research environments."},"roleDetails":{"sales":{"customerProblem":"AI developer tools in labs and agency pipelines are often unpatched because they sit outside central IT.","stakeholders":["Research computing security lead","Lab managers","Agency AI program lead"],"discoveryQuestions":["Where are Model-Optimizer and TensorRT installed?","Do AI environments have SBOMs?","Who approves model and checkpoint sources?"],"valueHypothesis":"Inventorying AI SDKs shortens response time for future bulletins (interpretation).","potentialEngagement":"A one-week AI software inventory and patch sweep across managed images.","unsupportedClaims":["Active exploitation","Remote unauthenticated attack (vector is local with user interaction)"]},"engineering":{"fit":"Applies wherever NVIDIA Model-Optimizer or TensorRT is used.","architectureIntegration":"Scan containers, notebooks and CI images; update to Model-Optimizer 0.44.0 and TensorRT 11.2.","prerequisites":["Package inventory or SBOM","Image rebuild pipeline"],"constraints":["Pinned research environments","Unmanaged researcher machines"],"security":"Block untrusted checkpoints; patch High-severity deserialization flaw promptly.","proofOfValue":["Scan for affected versions before and after patching"]},"delivery":{"work":"Run a patch campaign for NVIDIA AI SDKs and set model-intake rules.","dependencies":["Inventory tooling","Lab cooperation","Image pipeline"],"ownership":"Research computing security lead with lab managers.","skillsAdoption":"Researchers learn to check NVIDIA bulletins for SDKs they install.","governanceCheckpoints":["Inventory scan","Patch completion","Image rebuild"],"acceptanceCriteria":["No affected versions in managed images within 30 days (proposed)"],"risks":["Unmanaged laptops","Version pinning","Loading untrusted models"]}},"retrievedAt":"2026-10-07T03:02:39Z","enrichedAt":"2026-10-07T03:09:23Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Researchers who install their own tools need simple guidance on checking and updating versions.","procurementImplications":"AI platform contracts should state who patches bundled NVIDIA SDKs and how fast.","operatingModelImplications":"AI developer environments need to be in scope for vulnerability management.","sourceVerification":{"openedUrl":"https://github.com/NVIDIA/product-security/blob/main/2026/5903/5903.md","referenceExcerpt":"NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of untrusted data.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}