CVE-2026-72642— Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Elastic | Elasticsearch | 8.19.0≤ 8.19.19 | affected |
9.4.0≤ 9.4.4 | affected | ||
9.5.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-72642
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process
Source: CVE Program / CVE List V5
Vulnerability Description
The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with the privileges required to upload and deploy a trained model can craft a model that reads and writes memory outside the intended allocation. The result is heap corruption that crashes the inference process, and, with sufficient control over the heap layout, could allow arbitrary code execution in the context of that process.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用越界的指针偏移
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Elastic | Elasticsearch | 8.19.0 ~ 8.19.19 | - |
II. Public POCs for CVE-2026-72642
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-72642
请登录查看更多情报信息。
Other References for CVE-2026-72642 (1)
Same Patch Batch · Elastic · 2026-08-13 · 48 CVEs total
| CVE-2026-72665 | 8.1 HIGH | Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions |
| CVE-2026-72670 | 7.7 HIGH | Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure |
| CVE-2026-72672 | 7.7 HIGH | Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event D |
| CVE-2026-72669 | 7.6 HIGH | Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tamp |
| CVE-2026-72677 | 7.3 HIGH | Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Othe |
| CVE-2026-72658 | 7.3 HIGH | Cross-Site Request Forgery in Kibana Leading to Privilege Escalation |
| CVE-2026-72629 | 7.1 HIGH | Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access t |
| CVE-2026-72630 | 7.1 HIGH | Incorrect Authorization in Kibana Fleet Leading to Privilege Escalation |
| CVE-2026-72675 | 7.1 HIGH | Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclo |
| CVE-2026-72632 | 7.1 HIGH | Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearc |
| CVE-2026-72643 | 7.1 HIGH | Incorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Pri |
| CVE-2026-72666 | 6.8 MEDIUM | Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query E |
| CVE-2026-72674 | 6.5 MEDIUM | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Servic |
| CVE-2026-72660 | 6.5 MEDIUM | Uncaught Exception in Kibana Leading to Denial of Service |
| CVE-2026-72686 | 6.5 MEDIUM | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service |
| CVE-2026-72684 | 6.5 MEDIUM | Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of |
| CVE-2026-49089 | 6.5 MEDIUM | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Servic |
| CVE-2026-72651 | 6.5 MEDIUM | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Servic |
| CVE-2026-72661 | 6.5 MEDIUM | Missing Authorization in Kibana Leading to Information Disclosure |
| CVE-2026-72631 | 6.5 MEDIUM | Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Key |
Showing top 20 of 48 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Elasticsearch
- CVE-2026-72636
Uncontrolled Recursion in Elasticsearch Wildcard Matching Le - CVE-2026-72639
Memory Allocation with Excessive Size Value in Elasticsearch - CVE-2026-72638
Uncontrolled Recursion in Elasticsearch Leading to Denial of - CVE-2026-72647
Uncontrolled Recursion in Elasticsearch Leading to Denial of - CVE-2026-72645
Memory Allocation with Excessive Size Value in Elasticsearch
Same vendor: Elastic
- CVE-2026-49096
Uncaught Exception in Kibana Cases Leading to Denial of Serv - CVE-2026-72636
Uncontrolled Recursion in Elasticsearch Wildcard Matching Le - CVE-2026-72632
Observable Discrepancy in Kibana Fleet Leading to Disclosure - CVE-2026-72631
Improper Privilege Management in Kibana Fleet Leading to Ove - CVE-2026-72630
Incorrect Authorization in Kibana Fleet Leading to Privilege
Same weakness: CWE-823
- CVE-2026-49746
GPU DDK - Dimension Mismatch and Integer Truncation in PMRDe - CVE-2026-49745
GPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write int - CVE-2026-49744
GPU DDK - Unchecked ui32TracePointer in rgxfw_log_ex() - CVE-2026-21734
GPU DDK - libusc OOB write at TreeRemove during WebGPU shade - CVE-2026-34193
GPU DDK - Arbitrary write via UFO updates due insufficient p
V. Comments for CVE-2026-72642
No comments yet