Use-After-Free in NVIDIA Triton Inference Server

Executive Summary

NVIDIA Triton Inference Server for Linux has a flaw where an attacker can exploit an expired file descriptor. This causes the server to use a resource it should no longer have access to, potentially leading to a denial of service where the system becomes unavailable.

Useful 0 Not Useful 0

Detection Guidance

Detection of CVE-2026-47478 requires checking the version of NVIDIA Triton Inference Server running on your system. If the version is 0.0 up to and including 26.04, the system is vulnerable. Use commands like 'docker ps' (if running in containers) or 'dpkg -l | grep triton' (for Debian-based systems) to identify installed versions.

Useful 0 Not Useful 0

Impact Analysis

If you use NVIDIA Triton Inference Server for Linux versions up to 26.04, an attacker could exploit this to crash the server, making it unavailable for legitimate users. This disrupts services relying on the server for tasks like AI inference.

Useful 0 Not Useful 0

Compliance Impact

The provided CVE data does not specify direct impacts on compliance with standards like GDPR or HIPAA. The vulnerability primarily causes denial of service through expired file descriptors, which may disrupt services but lacks explicit compliance implications in the given context.

Useful 0 Not Useful 0

Mitigation Strategies

Update NVIDIA Triton Inference Server for Linux to a version beyond 26.04 to address the expired file descriptor vulnerability. Monitor NVIDIA's official security advisories for patches and apply them promptly.

Useful 0 Not Useful 0