Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-23318: NVIDIA Triton Inference Server Python Backend Allows Unwanted Code Execution

CVE-2025-23318 · published 1 year ago

Summary

NVIDIA's Triton Inference Server, used for AI model deployment, has a security issue in its Python component. This issue makes it possible for an attacker to execute unauthorized code, potentially disrupt service, access sensitive data, and tamper with data. Update your NVIDIA Triton Inference Server to the latest version to fix this issue.

What to do

Update nvidia triton_inference_server to version 25.07 or later.

Affected software

Vendor	Product	Affected versions
nvidia	triton_inference_server	< 25.07 `cpe:2.3:a:nvidia:triton_inference_server::::::::`

Original advisory text

NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, data tampering, and information disclosure.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-23318 US Government Resource
https://nvidia.custhelp.com/app/answers/detail/a_id/5687 Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2025-23318 Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.8 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-805Buffer Access with Incorrect Length Value

CWE-787Out-of-bounds Write

Timeline

Published6 Aug 2025

Updated31 Oct 2026

First seen7 Mar 2026

Sources

CVE-2025-23318 · NVD

Track software like this

Free during beta