EUVD-2026-41026
GHSA-2p66-jqj6-xc58
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable UAF with no auth required, but high complexity to trigger reliably; impact is availability-only with no confidentiality or integrity consequence.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a use-after-free issue. A successful exploit of this vulnerability might lead to denial of service.
AnalysisAI
Use-after-free memory corruption in NVIDIA Triton Inference Server on Linux enables remote attackers to crash the inference service. The vulnerability requires no authentication and no user interaction, but high attack complexity (CVSS AC:H) limits opportunistic exploitation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required (CVSS PR:N) and no user interaction is needed (CVSS UI:N), but CVSS AC:H confirms that exploitation requires overcoming high attack complexity - likely a race condition, heap grooming, or precise request sequencing to trigger the use-after-free reliably. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 5.9 (Medium) reflects a genuine tension between network reachability (AV:N, PR:N, UI:N) and high attack complexity (AC:H) with availability-only impact (A:H, C:N, I:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated remote attacker sends a sequence of crafted inference requests to a Triton server's network endpoint, triggering a race condition or specific memory deallocation sequence that causes the server to reference freed heap memory. The resulting use-after-free corrupts internal state and terminates the Triton process, denying inference service to all downstream clients. … |
| Remediation | Consult the NVIDIA Product Security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5848 for the vendor-released patch and exact fixed version - no specific fix version was confirmed in the available source data at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Triton Inference Server
View allNVIDIA Triton Server for Linux contains a vulnerability where an attacker may cause an improper validation of specified
NVIDIA Triton Inference Server contains a vulnerability where an attacker may cause an improper check for unusual or exc
Denial of service in NVIDIA Triton Inference Server for Linux allows remote unauthenticated attackers to exhaust server
NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where an attacker could cause a stack over
NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause a denial of
NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause memory corru
NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause an out-of-bo
NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker c
NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker may cause an improper inpu
NVIDIA Triton Inference Server for Windows and Linux and the Tensor RT backend contain a vulnerability where an attacker
NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker c
NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker c
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today