CVE-2026-24174
Nvidia Triton Inference Server ≤ 26.02
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2026-24174 is a high-severity Incorrect Conversion between Numeric Types (CWE-681) vulnerability in Nvidia Triton Inference Server. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 41th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-24174 is a vulnerability in the NVIDIA Triton Inference Server that enables an attacker to cause a server crash by sending a malformed request. This issue, published on 2026-04-07, is classified under CWE-681 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its impact on availability.
The vulnerability can be exploited by any unauthenticated attacker with network access to the server, requiring low attack complexity and no user interaction. Successful exploitation leads to a denial-of-service condition through server crashes, with no impact on confidentiality or integrity.
Mitigation details are available in official advisories, including the NVIDIA security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5816, the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-24174, and the CVE record at https://www.cve.org/CVERecord?id=CVE-2026-24174.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19757
Vulnerability Data
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request to the server. A successful exploit of this vulnerability might lead to denial of service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover incorrect numeric conversions through targeted test cases.
Engineering principles can mandate safe numeric handling and range checks that structurally avoid bad conversions.
Input validation directly stops malformed or out-of-range numeric values from reaching conversion logic.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require code reviews, static analysis, and developer training that catch and prevent numeric type-conversion errors.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect numeric conversion defects before release.
Secure development lifecycle includes type-safety and conversion checks that reduce numeric truncation risks.
Application security requirements can mandate safe numeric handling and range validation.
Secure architecture principles promote strong typing and safe conversion practices.
Secure coding standards directly address correct numeric type conversions and overflow checks.