Executive brief
NVIDIA Triton Inference Server, a platform used to deploy and manage artificial intelligence models, contains a security flaw in its DALI data processing component. An attacker could exploit this vulnerability to access sensitive information, disrupt server operations, or potentially take control of the system. This could lead to unauthorized data access or a complete shutdown of AI-driven business services.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the DALI (Data Loading Library) backend of the NVIDIA Triton Inference Server. The flaw is triggered when the component reads data past the end of the intended buffer. An attacker with low-level privileges can exploit this over a network, though it requires some level of user interaction. Successful exploitation can result in sensitive information disclosure, memory corruption leading to arbitrary code execution, or a denial of service (DoS) condition. Users are advised to refer to NVIDIA advisory 5828 for specific patching instructions.
Affected products
- NVIDIA Triton Inference Server All versions including DALI backend
Timeline
- 2026-05-20: disclosed: Initial publication of the CVE record.