CVE-2026-72642: The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operat
Summary
Elasticsearch has a vulnerability in its native inference process (the system that runs uploaded machine learning models) where it doesn't check that memory addresses (locations in computer memory) stay within allowed boundaries, allowing a user with model upload privileges to read or write memory outside intended areas, potentially crashing the process or executing arbitrary code.
Vulnerability Details
8.8(high)
EPSS: 0.0%
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
network
low
low
none
August 13, 2026
Classification
Taxonomy References
Affected Vendors
Related Issues
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-72642
First tracked: August 13, 2026 at 08:08 PM
Classified by LLM (prompt v3) · confidence: 92%