PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-24210 NVIDIA CVE debrief

Published on 2026-05-20, CVE-2026-24210 describes an integer overflow in NVIDIA Triton Inference Server that can be exploited remotely to cause denial of service. The issue is rated CVSS 7.5 (HIGH) with network attack vector, no privileges required, and no user interaction needed. According to the official records, affected Triton Inference Server versions are those before 26.03.

Vendor
NVIDIA
Product
Triton Inference Server
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-20
Original CVE updated
2026-05-20
Advisory published
2026-05-20
Advisory updated
2026-05-20

Who should care

Operators and administrators running NVIDIA Triton Inference Server, especially internet-facing or multi-tenant deployments, should treat this as a high-priority availability issue. Security teams, platform owners, and service teams that depend on Triton for inference workloads should confirm whether any deployed instances fall below version 26.03.

Technical summary

NVIDIA PSIRT attributes the flaw to CWE-190 (integer overflow). The NVD CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a remotely reachable, low-complexity attack path that impacts availability only. The official CPE criteria mark nvidia:triton_inference_server versions before 26.03 as vulnerable; the Linux kernel CPE entry in the source is marked not vulnerable.

Defensive priority

High. This is a remotely reachable denial-of-service issue with no authentication barrier, so exposed Triton services should be prioritized for inventory, patching, and operational hardening.

Recommended defensive actions

  • Inventory all NVIDIA Triton Inference Server deployments and identify any version earlier than 26.03.
  • Apply the vendor-recommended update or mitigation from NVIDIA PSIRT as soon as it is available in your environment.
  • Prioritize externally reachable and shared inference deployments for remediation first.
  • Monitor Triton service health, crashes, and restart events for signs of availability impact.
  • Confirm remediation against the official NVIDIA advisory and NVD/CVE record before closing the issue.

Evidence notes

This debrief is based only on the supplied official corpus: NVD, CVE.org, and the NVIDIA vendor advisory reference. The source record states the vulnerability affects NVIDIA Triton Inference Server versions before 26.03 and maps the weakness to CWE-190. The prompt’s vendor field lists Linux, but the official vulnerability references identify NVIDIA Triton Inference Server; the Linux kernel CPE in the source is explicitly marked not vulnerable.

Official resources

Publicly disclosed on 2026-05-20 through the official CVE and NVD records, with NVIDIA PSIRT listed as the source for the advisory references.