Introduction
A recently discovered stack buffer overflow in NVIDIA Triton Inference Server is a critical problem for anyone running AI infrastructure in production. It could let unauthenticated remote attackers execute arbitrary code, disrupt inference workloads, and access sensitive AI models and data.
About NVIDIA and Triton Inference Server: NVIDIA is a leading GPU and AI company, with a market capitalization above $2 trillion. Triton Inference Server is its widely used open-source platform for deploying AI models at scale, and it supports major frameworks like TensorFlow, PyTorch, and ONNX. Enterprise AI pipelines rely on it to run inference in cloud, edge, and on-premises environments.
Technical Information
CVE-2025-23310 is a stack buffer overflow in NVIDIA Triton Inference Server for Windows and Linux. The root cause is unsafe use of the alloca function in the server's HTTP request handling code. When the server processes an HTTP request with chunked transfer encoding, it allocates stack memory based on untrusted input. An attacker who sends a crafted request with a large number of chunks (for example, a 3MB request) can make the server allocate excessive stack memory and overflow the buffer.
The flaw affects several critical API endpoints, including repository index requests, inference requests, model management, and shared memory registration. Authentication is optional and disabled by default for most endpoints, which widens the attack surface. An attacker can trigger a segmentation fault that crashes the server and, in some cases, achieve remote code execution, information disclosure, or data tampering. Will Vandevanter of Trail of Bits found the issue, and it is tracked as CWE-121 (Stack-based Buffer Overflow).
As of this writing, no public source has published snippets of the vulnerable code.
Patch Information
NVIDIA has fixed several critical vulnerabilities in Triton Inference Server in version 25.07, including issues that could allow remote code execution, denial of service, information disclosure, and data tampering.
CVE-2025-23319 was an out-of-bounds write in the Python backend. The patch adds stricter input validation and bounds checking to prevent unauthorized memory access. For CVE-2025-23320, shared memory management now enforces limits that prevent excessive resource consumption. For CVE-2025-23334, error handling was changed to avoid unintended information disclosure.
Users are strongly advised to upgrade to Triton Inference Server version 25.07, which is available on NVIDIA's GitHub repository. NVIDIA's Secure Deployment Considerations Guide covers secure deployment practices in more detail.
Patch references:
- https://nvidia.custhelp.com/app/answers/detail/a_id/5687
- https://thehackernews.com/2025/08/nvidia-triton-bugs-let-unauthenticated.html
Affected Systems and Versions
- NVIDIA Triton Inference Server for Windows and Linux
- All versions prior to 25.07 are affected
- Vulnerable configurations include default installations where authentication is not enabled for API endpoints
Vendor Security History
NVIDIA has a dedicated Product Security Incident Response Team (PSIRT) and a history of responding quickly to critical vulnerabilities. Earlier Triton Inference Server issues include memory corruption vulnerabilities and unauthenticated attack vectors. Open source makes the codebase more transparent and also exposes it to more scrutiny. Trail of Bits and Wiz Research independently found multiple critical vulnerabilities in it.
