CVE-2025-23268 is a high severity (CVSS 8.0) improper input validation flaw in the DALI backend of NVIDIA Triton Inference Server that may lead to code execution. NVIDIA lists all DALI backend versions prior to 25.07 as affected. Upgrade the DALI backend to 25.07 or later.
What's affected
NVIDIA's September 2025 security bulletin for Triton Inference Server, released on 16 September 2025, lists the DALI backend with all versions prior to 25.07 affected and 25.07 as the updated version. The bulletin has been updated since, and the other four CVEs in it are fixed in Triton release 25.08.
The vector is AV:N/AC:H/PR:H/UI:N/S:C. That means network access, high attack complexity, high privileges and a changed scope. Those conditions explain the score of 8.0. NVIDIA credits users of Trend Micro's Zero Day Initiative for this report.
How to check if you're exposed
Check whether you use the DALI backend at all. It is a model backend for data preprocessing pipelines, and many Triton setups do not load it.
ls /opt/tritonserver/backends
docker images | grep -i tritonserver
In a model repository, look for models whose configuration names the dali backend. If you have one, compare the Triton or DALI backend release with 25.07. Also check who holds the privileges that the vector requires, such as access to the model control and repository APIs.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Upgrade the Triton release and DALI backend to 25.07 or later.
- Check whether the DALI backend is enabled and remove it from images that do not need it.
- Limit who can load or change models, and protect the model control APIs.
- Follow the Secure Deployment Considerations Guide, as the bulletin advises.
- Look at the other Triton CVEs in the September bulletin, which need 25.08.
Why it matters
CWE-20 is improper input validation. The DALI backend accepts input that it does not check well enough, and NVIDIA says that could lead to code execution. The bulletin offers no further detail.
The required privileges are high here, so this is not a flaw for an anonymous visitor. It matters in setups where many users or services can load models or send crafted pipelines. Reducing the number of backends in an image is a good habit on its own. Every backend you do not need is code you do not have to patch. The KEV flag is false.
Quick check
Which release fixes it?
DALI backend 25.07, per NVIDIA's September 2025 bulletin.
Why is the score lower than the critical Triton issues?
The vector needs high privileges and high attack complexity, though scope changes.
Sources
Last reviewed: 19 October 2026.
