What is the CVSS score of CVE-2026-24173?

CVE-2026-24173 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Nvidia are affected by CVE-2026-24173?

NVIDIA Triton Inference Server versions prior to r26.02 contain an integer overflow vulnerability that allows unauthenticated remote attackers to crash the inference service, directly impacting ML…

How to fix or mitigate CVE-2026-24173?

Within 24 hours: Inventory all NVIDIA Triton Inference Server deployments and document current versions; assess network exposure and whether instances accept untrusted remote connections. Within 7 days: Implement network segmentation and access controls to restrict inbound traffic to Triton servers to trusted sources only; monitor vendor advisories for r26.02 or later availability. Within 30 days: Upgrade all Triton Inference Server instances to r26.02 or later as soon as the patched version is available from NVIDIA; validate functionality post-upgrade in non-production environments first.

Nvidia CVE-2026-24173

EUVD-2026-19755 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-04-07 nvidia

Nvidia Denial Of Service Integer Overflow

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 17:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 07, 2026 - 18:00 euvd

EUVD-2026-19755

Analysis Generated

Apr 07, 2026 - 18:00 vuln.today

CVE Published

Apr 07, 2026 - 17:12 nvd

HIGH 7.5

DescriptionCVE.org

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request to the server. A successful exploit of this vulnerability might lead to denial of service.

AnalysisAI

Integer overflow in NVIDIA Triton Inference Server allows unauthenticated remote attackers to crash the server through malformed requests, causing denial of service. All versions prior to r26.02 are affected. CVSS 7.5 (High) with network attack vector, low complexity, and no authentication required. EPSS and KEV data not provided; no public exploit identified at time of analysis. Organizations running Triton Inference Server for ML model deployment should prioritize patching to prevent service disruption.

Technical ContextAI

NVIDIA Triton Inference Server is an open-source inference serving platform for deploying machine learning models at scale. This vulnerability stems from an integer overflow weakness (CWE-190), where arithmetic operations on integer values can wrap around beyond maximum or minimum representable values. When processing network requests, the server fails to properly validate or bound certain integer calculations, allowing specially crafted malformed requests to trigger overflow conditions. The affected component is cpe:2.3:a:nvidia:triton_inference_server, indicating the core server application across all deployment configurations. Integer overflows in network-facing services typically occur during buffer size calculations, memory allocation routines, or protocol parsing logic, potentially causing crashes through memory corruption or assertion failures when the resulting invalid values propagate through the system.

RemediationAI

Upgrade to NVIDIA Triton Inference Server release r26.02 or later, which contains fixes for the integer overflow vulnerability. Download the patched version from the official NVIDIA NGC catalog or GitHub repository at github.com/triton-inference-server/server. For containerized deployments, pull updated container images tagged r26.02 or newer from nvcr.io/nvidia/tritonserver. Verify the patch by checking the release version post-upgrade. As a temporary mitigation for environments where immediate patching is not feasible, implement network-level controls to restrict Triton server access to trusted clients only using firewall rules, authentication proxies, or network segmentation. Deploy request validation and rate limiting at the load balancer or API gateway layer to filter malformed requests before they reach the inference server. Monitor server logs for unusual crash patterns or repeated connection attempts with malformed data. Consult the complete remediation guidance in NVIDIA's security advisory at https://nvidia.custhelp.com/app/answers/detail/a_id/5816 for additional mitigation strategies and deployment-specific recommendations.