CVE-2026-47477: NVIDIA Triton Buffer Overflow Vulnerability

CVE-2026-47477 Overview

CVE-2026-47477 affects NVIDIA Triton Inference Server for Linux. The vulnerability is a stack-based buffer overflow [CWE-121] that a remote attacker can trigger over the network without authentication or user interaction. Successful exploitation leads to denial of service by disrupting the availability of the inference server process.

Triton Inference Server is widely deployed to serve machine learning models in production environments. A crash of the service interrupts model inference workloads and dependent applications. The flaw does not impact confidentiality or integrity, but the availability impact is high.

Critical Impact
Remote, unauthenticated attackers can crash NVIDIA Triton Inference Server instances by sending crafted network input that overflows a stack buffer, resulting in denial of service.

Affected Products

NVIDIA Triton Inference Server for Linux

Discovery Timeline

2026-07-14 - CVE-2026-47477 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-47477

Vulnerability Analysis

CVE-2026-47477 is a stack-based buffer overflow in NVIDIA Triton Inference Server for Linux. Stack overflows occur when a function writes more data to a fixed-size stack buffer than it can hold. The excess bytes overwrite adjacent stack memory, including saved return addresses and frame pointers.

The vulnerability is reachable over the network without prior authentication. Attackers do not require any user interaction to trigger the flaw. According to the advisory, the observed outcome is denial of service rather than code execution. This suggests that the corruption causes a process crash through stack canary checks or invalid memory access rather than a controlled hijack of execution flow.

Root Cause

The underlying weakness is classified as [CWE-121] Stack-based Buffer Overflow. The server fails to validate the length of attacker-controlled input before copying it into a fixed-size stack buffer. When the input exceeds the buffer size, adjacent stack memory is corrupted and the process terminates.

Attack Vector

An attacker sends a crafted request to a network-exposed Triton Inference Server endpoint. The malformed payload triggers the vulnerable code path that copies data into the stack buffer without bounds checking. The server process crashes, denying inference services to legitimate clients until the process is restarted.

Technical specifics of the vulnerable component and request format are not published in the NVD entry. Refer to the NIST Vulnerability CVE-2026-47477 entry and the CVE.org Record CVE-2026-47477 for further advisories as they become available.

Detection Methods for CVE-2026-47477

Indicators of Compromise

Unexpected termination or repeated restarts of the tritonserver process on Linux hosts.
Segmentation fault or stack smashing messages in system logs referencing the Triton process.
Anomalously large or malformed inbound requests directed at Triton HTTP, gRPC, or metrics endpoints.

Detection Strategies

Monitor process supervision logs and container orchestrator events for repeated crash-restart cycles of Triton Inference Server pods or services.
Inspect kernel and audit logs for SIGSEGV or SIGABRT signals delivered to tritonserver.
Correlate crash events with inbound network traffic captured at reverse proxies or service meshes fronting the inference server.

Monitoring Recommendations

Enable application-level health checks and alert when Triton readiness probes fail unexpectedly.
Log all inbound requests to Triton endpoints at the ingress layer to support post-incident analysis.
Deploy network detection rules to flag oversized payloads targeting Triton service ports (default 8000, 8001, 8002).

How to Mitigate CVE-2026-47477

Immediate Actions Required

Restrict network access to Triton Inference Server endpoints so that only trusted clients can reach the HTTP, gRPC, and metrics ports.
Place Triton behind an authenticating reverse proxy or service mesh that enforces request size limits and input validation.
Enable automated process restart and container health checks to reduce downtime if the server is crashed.

Patch Information

Consult NVIDIA's product security advisories for the fixed version of Triton Inference Server addressing CVE-2026-47477. Upgrade all Linux deployments to the patched release once available. Reference the NIST Vulnerability CVE-2026-47477 entry for updates on vendor-supplied fixes.

Workarounds

Isolate Triton Inference Server on private networks or VPCs and block external exposure at the firewall or security group level.
Enforce request size limits and schema validation at an upstream API gateway to reject malformed inference requests before they reach the server.
Run Triton within a hardened container with resource limits and automatic restart policies to contain the blast radius of a crash.

bash

# Configuration example: restrict Triton to localhost and rely on an authenticated reverse proxy
tritonserver \
  --model-repository=/models \
  --http-address=127.0.0.1 \
  --grpc-address=127.0.0.1 \
  --allow-metrics=false