NVIDIA Triton Python Backend RCE Chain
- Product
- NVIDIA Triton Inference Server
- CVE
- CVE-2025-23319CVE-2025-23320CVE-2025-23334
- Disclosed
- 2025-08-06
- CVSS
- 8.1
- Auth
- pre-auth
- CISA KEV
- no
- Affected
- Triton Inference Server < 25.07 (Python backend)
- Fixed
- 25.07
Summary
Wiz chained three bugs in Triton's Python backend into unauthenticated remote takeover of the inference server. An info leak revealed the name of a private shared-memory region, which was then abused for out-of-bounds read/write.
Root cause
CVE-2025-23320: an oversized request triggered an error message that leaked the backend's internal IPC shared-memory key. CVE-2025-23319/23334: Triton's shared-memory API accepted that private key as if it were a user-registered region, allowing out-of-bounds writes and reads into the backend's own memory, which corrupts IPC structures to achieve code execution.
Impact
Unauthenticated remote code execution on Triton servers, enabling model theft, response manipulation and lateral movement.
Detection
Check Triton release (< 25.07) and whether the Python backend is loaded; watch for shared-memory registration requests referencing internal 'triton_python_backend_shm_region' names.
Mitigation
Upgrade to 25.07 and do not expose Triton HTTP/gRPC endpoints to untrusted clients.