CVE-2026-24266 - Vulnerability Details

Description

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a use-after-free issue. A successful exploit of this vulnerability might lead to denial of service.

Published: 2026-07-01

Score: 5.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

NVIDIA Triton Inference Server for Linux contains a use‑after‑free bug that can cause the server process to crash when an attacker accesses freed memory. A malicious inference request can trigger the crash, leading to a denial of service for legitimate clients. The vulnerability does not affect confidentiality or integrity, only availability.

Affected Systems

All deployments of NVIDIA Triton Inference Server running on Linux are potentially affected. The vendor has not identified specific versions, so any currently installed release may be vulnerable until a vendor‑supplied fix is released.

Risk and Exploitability

The CVSS score of 5.9 indicates moderate severity, and the EPSS score of less than 1 % suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. An attacker could plausibly trigger the crash remotely by sending a crafted request to the inference endpoint; no public exploit has been reported.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

NVIDIA

Triton Inference Server

unaffected

Version	Status	Constraints
`0.0 - 26.03`	affected	—

No data.

Vendor Product Confidence Versions

Nvidia

Triton Inference Server

100%

Version	Status	Scheme	Platform
`[0.0,26.03]`	affected	generic	['linux']

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Register with NVIDIA’s security advisory system and download the latest Triton Inference Server patch when it becomes available.
Restrict external access to the inference endpoints using firewall rules or IP whitelisting to reduce the attack surface.
Configure the Triton service to automatically restart on crash and monitor its health to maintain high availability.

Generated by OpenCVE AI on August 1, 2026 at 23:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00446.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/NVIDIA/product-security/tree/main/2026/5848
https://nvd.nist.gov/vuln/detail/CVE-2026-24266
https://www.cve.org/CVERecord?id=CVE-2026-24266

History

Sat, 01 Aug 2026 23:30:00 +0000

Type	Values Removed	Values Added
Title		Use-After-Free Leading to Denial of Service in NVIDIA Triton Inference Server

Tue, 28 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Title	Use-After-Free Leading to Denial of Service in NVIDIA Triton Inference Server for Linux

Fri, 24 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Title		Use-After-Free Leading to Denial of Service in NVIDIA Triton Inference Server for Linux

Tue, 21 Jul 2026 14:30:00 +0000

Type	Values Removed	Values Added
Title	Use-After-Free in NVIDIA Triton Inference Server for Linux Leading to Denial of Service

Fri, 17 Jul 2026 13:00:00 +0000

Type	Values Removed	Values Added
Title		Use-After-Free in NVIDIA Triton Inference Server for Linux Leading to Denial of Service

Thu, 16 Jul 2026 12:00:00 +0000

Type	Values Removed	Values Added
Title	Use‑After‑Free in NVIDIA Triton Inference Server Causes Denial of Service

Tue, 14 Jul 2026 18:45:00 +0000

Type	Values Removed	Values Added
Title		Use‑After‑Free in NVIDIA Triton Inference Server Causes Denial of Service

Tue, 14 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Title	Use-After-Free causing Denial of Service in NVIDIA Triton Inference Server

Sun, 12 Jul 2026 09:45:00 +0000

Type	Values Removed	Values Added
Title		Use-After-Free causing Denial of Service in NVIDIA Triton Inference Server

Sat, 11 Jul 2026 08:15:00 +0000

Type	Values Removed	Values Added
Title	Use‑After‑Free Denial of Service in NVIDIA Triton Inference Server

Fri, 10 Jul 2026 17:00:00 +0000

Type	Values Removed	Values Added
Title		Use‑After‑Free Denial of Service in NVIDIA Triton Inference Server

Thu, 09 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Title	Use-After-Free in NVIDIA Triton Inference Server Leading to Denial of Service

Wed, 08 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Title		Use-After-Free in NVIDIA Triton Inference Server Leading to Denial of Service

Wed, 08 Jul 2026 07:45:00 +0000

Type	Values Removed	Values Added
Title	Use-After-Free Vulnerability in NVIDIA Triton Inference Server Leading to Denial of Service

Tue, 07 Jul 2026 15:00:00 +0000

Type	Values Removed	Values Added
Title		Use-After-Free Vulnerability in NVIDIA Triton Inference Server Leading to Denial of Service

Tue, 07 Jul 2026 02:45:00 +0000

Type	Values Removed	Values Added
Title	Use‑After‑Free in NVIDIA Triton Inference Server Causes Server Crash

Mon, 06 Jul 2026 15:15:00 +0000

Type	Values Removed	Values Added
Title		Use‑After‑Free in NVIDIA Triton Inference Server Causes Server Crash

Mon, 06 Jul 2026 03:00:00 +0000

Type	Values Removed	Values Added
Title	Use-After-Free in NVIDIA Triton Inference Server Leading to Denial of Service

Sun, 05 Jul 2026 13:45:00 +0000

Type	Values Removed	Values Added
Title		Use-After-Free in NVIDIA Triton Inference Server Leading to Denial of Service

Sun, 05 Jul 2026 03:15:00 +0000

Type	Values Removed	Values Added
Title	NVIDIA Triton Inference Server Use-After-Free Vulnerability Leading to Denial of Service

Sat, 04 Jul 2026 06:45:00 +0000

Type	Values Removed	Values Added
Title		NVIDIA Triton Inference Server Use-After-Free Vulnerability Leading to Denial of Service

Fri, 03 Jul 2026 16:00:00 +0000

Type	Values Removed	Values Added
Title	Use-After-Free Vulnerability in NVIDIA Triton Inference Server Causing Denial of Service

Fri, 03 Jul 2026 04:45:00 +0000

Type	Values Removed	Values Added
Title		Use-After-Free Vulnerability in NVIDIA Triton Inference Server Causing Denial of Service

Thu, 02 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Title	Use-After-Free in NVIDIA Triton Inference Server Leading to Denial of Service

Thu, 02 Jul 2026 05:30:00 +0000

Type	Values Removed	Values Added
Title		Use-After-Free in NVIDIA Triton Inference Server Leading to Denial of Service

Thu, 02 Jul 2026 01:15:00 +0000

Type	Values Removed	Values Added
Title	Use‑After‑Free on NVIDIA Triton Inference Server Leading to Denial of Service

Wed, 01 Jul 2026 23:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Nvidia Nvidia triton Inference Server
Vendors & Products		Nvidia Nvidia triton Inference Server

Wed, 01 Jul 2026 20:00:00 +0000

Type	Values Removed	Values Added
Title		Use‑After‑Free on NVIDIA Triton Inference Server Leading to Denial of Service

Wed, 01 Jul 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 01 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a use-after-free issue. A successful exploit of this vulnerability might lead to denial of service.
Weaknesses		CWE-416
References		https://github.com/NVIDIA/product-security/tree/main/2026/5848 https://nvd.nist.gov/vuln/detail/CVE-2026-24266 https://www.cve.org/CVERecord?id=CVE-2026-24266
Metrics		cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Subscriptions

Nvidia Triton Inference Server

MITRE

Status: PUBLISHED

Assigner: nvidia

Published: 2026-07-01T15:11:30.422Z

Updated: 2026-07-01T15:55:42.553Z

Reserved: 2026-01-21T19:09:49.054Z

Link: CVE-2026-24266

Vulnrichment

Updated: 2026-07-01T15:55:39.245Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-01T23:15:03Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object