PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-24210 NVIDIA CVE debrief

Published on 2026-05-20, CVE-2026-24210 describes an integer overflow in NVIDIA Triton Inference Server that can be exploited remotely to cause denial of service. The issue is rated CVSS 7.5 (HIGH) with network attack vector, no privileges required, and no user interaction needed. According to the official records, affected Triton Inference Server versions are those before 26.03.

Vendor
NVIDIA
Product
Triton Inference Server
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-20
Original CVE updated
2026-07-24
Advisory published
2026-05-20
Advisory updated
2026-07-24

Who should care

Operators and administrators running NVIDIA Triton Inference Server, especially internet-facing or multi-tenant deployments, should treat this as a high-priority availability issue. Security teams, platform owners, and service teams that depend on Triton for inference workloads should confirm whether any deployed instances fall below version 26.03.

Technical summary

NVIDIA PSIRT attributes the flaw to CWE-190 (integer overflow). The NVD CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a remotely reachable, low-complexity attack path that impacts availability only. The official CPE criteria mark nvidia:triton_inference_server versions before 26.03 as vulnerable; the Linux kernel CPE entry in the source is marked not vulnerable.

Defensive priority

High. This is a remotely reachable denial-of-service issue with no authentication barrier, so exposed Triton services should be prioritized for inventory, patching, and operational hardening.

Recommended defensive actions

  • Inventory all NVIDIA Triton Inference Server deployments and identify any version earlier than 26.03.
  • Apply the vendor-recommended update or mitigation from NVIDIA PSIRT as soon as it is available in your environment.
  • Prioritize externally reachable and shared inference deployments for remediation first.
  • Monitor Triton service health, crashes, and restart events for signs of availability impact.
  • Confirm remediation against the official NVIDIA advisory and NVD/CVE record before closing the issue.

Evidence notes

This debrief is based only on the supplied official corpus: NVD, CVE.org, and the NVIDIA vendor advisory reference. The source record states the vulnerability affects NVIDIA Triton Inference Server versions before 26.03 and maps the weakness to CWE-190. The prompt’s vendor field lists Linux, but the official vulnerability references identify NVIDIA Triton Inference Server; the Linux kernel CPE in the source is explicitly marked not vulnerable.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-24210 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-24210

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-24210 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-24210

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.