CVE-2025-33254
Published: 24 March 2026
Summary
CVE-2025-33254 is a high-severity Race Condition (CWE-362) vulnerability in Nvidia Triton Inference Server. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly addresses the race condition vulnerability in NVIDIA Triton Inference Server by applying patches to prevent internal state corruption and denial of service.
Denial-of-service protection implements mechanisms to block or limit exploits causing state corruption and high-impact availability disruption.
Resource availability protections ensure system resources are safeguarded against unauthorized depletion from the race condition-induced denial of service.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated exploitation of public-facing Triton server (T1190) directly achieves application-layer DoS via state corruption (T1499.004).
NVD Description
NVIDIA Triton Inference Server contains a vulnerability where an attacker may cause internal state corruption. A successful exploit of this vulnerability may lead to a denial of service.
Deeper analysisAI
CVE-2025-33254 affects NVIDIA Triton Inference Server, where an attacker can cause internal state corruption. A successful exploit leads to a denial of service condition. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-362 (race condition) and NVD-CWE-noinfo. It was published on 2026-03-24.
The vulnerability enables a remote, unauthenticated attacker to exploit it over the network with low complexity and no user interaction required. Successful exploitation results in high-impact denial of service through internal state corruption, with no impact on confidentiality or integrity.
Mitigation guidance and additional details are provided in the NVIDIA security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5790, the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-33254, and the CVE record at https://www.cve.org/CVERecord?id=CVE-2025-33254.
Details
- CWE(s)