CVE-2026-24214 is a high severity (CVSS 8.0) integer overflow in the DALI backend of NVIDIA Triton Inference Server. Versions before r26.03 are affected, and r26.03 fixes it. Update the server image, and review which of your models and pipelines actually use the DALI backend.
What's affected
NVIDIA's May 2026 Triton bulletin lists the DALI backend, all versions before r26.03, as affected, with r26.03 as the updated version. It sits in the same release as CVE-2026-24213 and CVE-2026-24215.
The CVSS vector is network based with low privileges and user interaction required. NVIDIA lists code execution, data tampering and denial of service as possible impacts.
How to check if you're exposed
List the Triton image tags in use:
docker images | grep tritonserver
Tags starting with 26.03 or later include the fix. Also check your model repository for DALI pipelines, so you know which services depend on the backend.
For a quick look at your own dependencies, Safeguard's free in-browser dependency scan at https://gold.safeguard.sh/scan checks them against known CVEs in your browser.
What to do now
- Update Triton Inference Server to r26.03 or later.
- Rebuild and redeploy all images that pin older tags.
- Limit who can submit models or pipelines to the server.
- Drop the DALI backend from images that do not need it.
Why it matters
The weakness is CWE-190, integer overflow or wraparound. A calculation produces a number too large for its type, wraps around, and the program then uses the wrong size. That commonly feeds memory corruption, which is why NVIDIA lists code execution among the impacts.
Exploitation here needs a privileged enough account and a user action, which makes mass exploitation less likely. It is not listed in CISA's Known Exploited Vulnerabilities catalog.
Quick check
What does the integer overflow lead to?
NVIDIA lists code execution, data tampering and denial of service as possible impacts.
Which release fixes it?
r26.03 of Triton Inference Server.
Sources
Last reviewed: 19 October 2026.
