CVE-2025-23319 / CVE-2025-23320 / CVE-2025-23334: The Three-Step Chain That Handed Attackers Your AI Models
| CVE | Score | Component | Patched | Disclosed |
|---|---|---|---|---|
| CVE-2025-23320 | 7.5 High | Triton Inference Server — Python backend | v25.07 | August 4, 2025 |
| CVE-2025-23319 | 8.1 High | Triton Inference Server — Python backend | v25.07 | August 4, 2025 |
| CVE-2025-23334 | 5.9 Medium | Triton Inference Server — Python backend | v25.07 | August 4, 2025 |
Discovered by Ronen Shustin, Nir Ohfeld, Sagi Tzadik, Hillai Ben-Sasson, Andres Riancho, and Yuval Avrahami (Wiz Research).
For executives
In August 2025, Wiz Research disclosed a three-stage vulnerability chain in Triton's Python backend that allowed an unauthenticated attacker, with no credentials and no prior access, to gain complete control of the server. Five public proof-of-concept exploits appeared on GitHub within days of disclosure.
Step one: the information leak (CVE-2025-23320, CVSS 7.5)
When an attacker sends a large, crafted inference request that exceeds the shared memory pool size, the server generates an error. That error message includes the full name of the internal shared memory region — the private GUID — in plain text. One crafted request. One error response. The attacker now has the private key to the server's internal shared memory.
Step two: unauthorised memory access (CVE-2025-23319, CVSS 8.1)
Triton's public API for registering shared memory regions does not validate whether a key being registered belongs to the user or to an internal server region. An attacker who knows the private key can register the server's own internal shared memory region. The server grants them full read and write access to its private backend memory.
Step three: code execution (CVE-2025-23334, CVSS 5.9)
With read and write access to the Python backend's private shared memory, an attacker can corrupt IPC control structures, redirecting execution flow. The result is remote code execution on the Triton server. Three requests to a Triton HTTP or gRPC endpoint. No authentication. No credentials.
What an attacker can do from here
Full control gives an attacker access to proprietary AI models, live inference data (including user inputs), the ability to manipulate model outputs, and a positioned node for lateral movement into adjacent infrastructure.
Patch and mitigation
Upgrade both NVIDIA Triton Inference Server and the Python backend to version 25.07 or later. The patch must be applied to both components. Protect HTTP and gRPC endpoints with authentication controls regardless of patch status.