Nvidia has released critical patches for its Triton Inference Server, addressing a series of vulnerabilities that could allow remote, unauthenticated attackers to execute code and take over servers running AI models. The vulnerabilities, disclosed by Wiz Research, include CVE-2025-23319, CVE-2025-23320, and CVE-2025-23334, with CVSS scores ranging from 5.9 to 8.1, indicating their severity. These flaws can lead to the theft of AI models, sensitive data exposure, and manipulation of model responses. 'When chained together, these flaws can potentially allow a remote, unauthenticated attacker to gain complete control of the server,' stated Wiz researchers Ronen Shustin and Nir Ohfeld. The vulnerabilities stem from issues in the Python backend of the Triton Inference Server, which is designed to run models from various AI frameworks.
The Triton Inference Server is a popular open-source platform, supporting major AI frameworks like TensorFlow and PyTorch through its modular backends. It allows organizations to deploy AI models at scale. The vulnerabilities discovered include a memory leak that can be exploited by sending oversized requests, leading to potential remote code execution. The researchers noted that a combination of these vulnerabilities could transform a simple information leak into a full system compromise without requiring any user credentials.
The timeline of these vulnerabilities began with their discovery by Wiz Research, who promptly reported them to Nvidia. In response, Nvidia released version 25.07 of the Triton Inference Server, which addresses these vulnerabilities. 'This research demonstrates how a series of seemingly minor flaws can be chained together to create a significant exploit,' the researchers noted.
In the wake of the disclosure, industry experts have emphasized the importance of immediate patching. Nvidia has urged all users of the Triton Inference Server to upgrade to the patched version as soon as possible. The security community is also monitoring for active exploitation, especially given the availability of public exploit code, which could facilitate attacks. Organizations are advised to conduct thorough vulnerability assessments and apply the latest patches to safeguard their AI infrastructure.
