Wiz Details Triton Inference Server Vulnerability Chain That Could Enable Remote Takeover
Summary
Wiz describes how flaws in Triton’s Python backend could let an unauthenticated remote attacker access internal shared memory and potentially take over a server. NVIDIA patched the issues in version 25.07.
Key points
- Wiz says a crafted large request can trigger an error that reveals the Python backend’s internal shared-memory name.
- Triton’s shared-memory API does not validate whether a supplied key refers to a private internal region, according to the research.
- Using the leaked name, an attacker could access backend memory through ordinary API calls, gaining read and write capabilities.
- Wiz outlines potential paths to remote code execution, including corrupting memory structures or manipulating IPC messages; it withheld further exploitation details.
- The vulnerability chain could expose models and data, alter model responses, or provide a foothold for attacks on other systems.
- NVIDIA assigned CVE-2025-23319, CVE-2025-23320, and CVE-2025-23334 and released fixes; users are advised to update Triton Inference Server and its Python backend to version 25.07.
Article Details
- Attack Vectors
- A crafted, large remote request triggers an error that discloses the Python backend's internal shared-memory name.
- An attacker uses the leaked name with Triton's shared-memory registration API, then sends inference requests that read from or write to the backend's private memory.
- Manipulating shared-memory data structures or crafting IPC messages may enable memory corruption or logical exploitation leading to remote code execution.
- Defensive Notes
- Upgrade NVIDIA Triton Inference Server and the Python backend to version 25.07, as advised in the NVIDIA security bulletin.
- Wiz recommends identifying vulnerable instances with its Vulnerability Findings page or Security Graph; Wiz customers can also use Dynamic Scanner, runtime findings, and one-click remediation where applicable.
CVE
CVE-2025-23319and swift response. NVIDIA has assigned the following identifiers to this vulnerability chain: CVE-2025-23319, CVE-2025-23320, and CVE-2025-23334. We strongly recommend all Triton Inference Server users updateCVE-2025-23320response. NVIDIA has assigned the following identifiers to this vulnerability chain: CVE-2025-23319, CVE-2025-23320, and CVE-2025-23334. We strongly recommend all Triton Inference Server users update to the latestCVE-2025-23334assigned the following identifiers to this vulnerability chain: CVE-2025-23319, CVE-2025-23320, and CVE-2025-23334. We strongly recommend all Triton Inference Server users update to the latest version. This post
People
Andres RianchoNamed member of the Wiz Research team that reported and disclosed the vulnerability chain.Hillai Ben-SassonNamed member of the Wiz Research team that reported and disclosed the vulnerability chain.Nir OhfeldNamed member of the Wiz Research team that reported and disclosed the vulnerability chain.Ronen ShustinNamed member of the Wiz Research team that reported and disclosed the vulnerability chain.Sagi TzadikNamed member of the Wiz Research team that reported and disclosed the vulnerability chain.Yuval AvrahamiNamed member of the Wiz Research team that reported and disclosed the vulnerability chain.
Vendors
Products
Python backendThis attack path originates in the server's Python backend and starts with a minor information leak that cleverly escalates into a full system compromise. This poses a critical risk to organizations using Triton forTriton Inference ServerThe Wiz Research team has discovered a chain of critical vulnerabilities in NVIDIA's Triton Inference Server, a popular open-source platform for running AI models at scale. When chained together, these flaws can