NVIDIA Triton Inference Server CVE-2026-24214

Exploitation requires (1) the target Triton Inference Server deployment must have the DALI backend enabled and loaded, (2) the attacker must hold low-privilege authenticated access to submit inference requests or model/pipeline configurations to the Triton API (PR:L), and (3) user interaction is required (UI:R), implying an operator or another user must trigger loading or execution of the attacker-supplied DALI pipeline. Exploitation is limited by these factors: deployments not using the DALI backend are not exploitable, anonymous unauthenticated network attackers cannot directly exploit the flaw, and the UI:R requirement excludes fully automated drive-by exploitation against headless services.

CVSS 8.0 (High) reflects network-reachable exploitation (AV:N) with low complexity (AC:L) but requires low privileges (PR:L) and user interaction (UI:R), with high impact across confidentiality, integrity, and availability. EPSS score is not provided in the input data. The CVE is not listed in CISA KEV and no public exploit code has been identified, indicating no confirmed active exploitation. The PR:L + UI:R combination materially limits real-world attack surface - exploitation likely requires an authenticated model-deployment user submitting or triggering a malicious DALI pipeline, not anonymous internet exploitation. Real-world risk is highest in multi-tenant ML serving environments where untrusted users can submit models or preprocessing configurations; in single-tenant internal deployments the practical risk is lower despite the High CVSS.

An authenticated user with permission to submit inference requests or model configurations crafts a malicious payload - for example, a manipulated tensor shape, batch size, or preprocessing parameter - that triggers integer overflow inside the DALI backend's allocation or indexing logic. After luring an operator into loading or executing the malicious model/pipeline (satisfying the UI:R requirement), the resulting memory corruption can be steered toward arbitrary code execution under the Triton server process, tampering with served model outputs, or crashing the inference service. No public exploit code has been identified at time of analysis.