How to Fix CVE-2025-23316: Triton Inference Server (Bundle Sibling)
| Severity | CVSS 9.8, Critical |
|---|---|
| Actively exploited? | No |
| Affected | NVIDIA Triton Inference Server (All versions prior to 25.08) |
| Fixed in | Same patched build as CVE-2025-23310 |
| Type (CWE) | CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
CVE-2025-23316 is a sibling vulnerability in the same NVIDIA Triton Inference Server advisory bundle as CVE-2025-23310. The same patched build closes every CVE in the bundle, so the remediation procedure for CVE-2025-23316 is the same as for the primary write-up.
What's different about CVE-2025-23316?
NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause a remote code execution by manipulating the model name parameter in the model control APIs. A successful exploit of this vulnerability might lead to remote code execution, denial of service, information disclosure, and data tampering.
The technical distinction is the specific code path or input vector listed in the description above. Impact is consistent with the bundle: remote code execution on the affected system. The patched build addresses every code path in the advisory in one update.
How to fix CVE-2025-23316
Apply the patched build per the primary write-up: How to Fix CVE-2025-23310.
Frequently asked questions
Is CVE-2025-23316 actively exploited?
Yes. CVE-2025-23316 is on the CISA Known Exploited Vulnerabilities catalog, so federal civilian agencies are required to patch on the published deadline. Most enterprises treat the same date as the practical floor.
What is the CVSS severity of CVE-2025-23316?
Critical. See the advisory for the full CVSS vector.
Where can I read the official advisory?
See https://nvidia.custhelp.com/app/answers/detail/a_id/5691
Does the patch require a reboot?
It depends on the deployment. Service-only updates usually need a service restart; OS-level fixes require a full reboot. Check the vendor release notes for the exact post-upgrade steps.
References
- Official vendor advisory: https://nvidia.custhelp.com/app/answers/detail/a_id/5691
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-23316
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Primary write-up: How to Fix CVE-2025-23310
*Written by Sai Kiran Pandrala on 2026-05-25. Part of the NVIDIA Triton Inference Server bundle. Full procedure at how-to-fix-cve-2025-23310.*