What is the CVSS score of CVE-2026-24214?

CVE-2026-24214 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of NVIDIA Triton Inference Server are affected by CVE-2026-24214?

NVIDIA Triton Inference Server's DALI backend contains an integer overflow vulnerability allowing authenticated attackers to achieve code execution or denial of service against inference workloads.

How to fix or mitigate CVE-2026-24214?

Within 24 hours: Audit all deployments exposing DALI inference backend; implement network-level access controls to limit exposure to inference APIs. Within 7 days: Enable and enforce strong authentication on inference endpoints; restrict DALI pipeline access to trusted internal networks only; log and monitor inference API activity for anomalies. Within 30 days: Evaluate vendor patch timeline; assess criticality of DALI backend to operations and plan migration or segmentation strategy as alternative.

NVIDIA Triton Inference Server CVE-2026-24214

EUVD-2026-31054 CRITICAL

Integer Overflow or Wraparound (CWE-190)

2026-05-20 nvidia

GHSA-p35h-3896-r5hv

Nvidia Denial Of Service RCE Integer Overflow Triton Inference Server

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Jul 24, 2026 - 10:22 vuln.today

cvss_changed

Severity Changed

Jul 24, 2026 - 10:22 NVD

HIGH CRITICAL

CVSS changed

Jul 24, 2026 - 10:22 NVD

8.0 (HIGH) 9.8 (CRITICAL)

Analysis Generated

May 20, 2026 - 04:02 vuln.today

DescriptionNVD

NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an integer overflow. A successful exploit of this vulnerability might lead to code execution, data tampering, or denial of service.

AnalysisAI

Integer overflow in the DALI backend of NVIDIA Triton Inference Server allows authenticated remote attackers to trigger memory corruption that may result in code execution, data tampering, or denial of service. The flaw requires low-level privileges plus user interaction (CVSS 8.0, AV:N/AC:L/PR:L/UI:R) and affects deployments exposing the DALI inference pipeline. No public exploit identified at time of analysis.

Technical ContextAI

Triton Inference Server is NVIDIA's open-source platform for serving AI/ML models across frameworks (TensorFlow, PyTorch, ONNX, TensorRT). The DALI (Data Loading Library) backend accelerates data preprocessing pipelines on GPUs for inference workloads. The root cause is CWE-190 (Integer Overflow or Wraparound) - arithmetic operations on attacker-influenced size or count values wrap past integer bounds, producing undersized allocations or out-of-bounds memory accesses during DALI's data handling. The affected CPE is cpe:2.3:a:nvidia:triton_inference_server with versions unspecified, indicating the version range is to be defined by the vendor advisory.

RemediationAI

Patch available per vendor advisory at https://nvidia.custhelp.com/app/answers/detail/a_id/5828 - administrators should consult NVIDIA's security bulletin for the exact fixed Triton Inference Server release and upgrade accordingly. Until patched, compensating controls include disabling the DALI backend in Triton's model configuration if not required (trade-off: loss of GPU-accelerated preprocessing performance), restricting model upload and inference-request access to trusted authenticated users only via network segmentation and authentication proxies (trade-off: reduced accessibility for legitimate ML practitioners), and reviewing DALI pipeline definitions for untrusted user input. Additional NVD references are https://nvd.nist.gov/vuln/detail/CVE-2026-24214 and https://www.cve.org/CVERecord?id=CVE-2026-24214.