Heap Corruption Vulnerability in Elasticsearch Affects Machine Learning Models

CVE-2026-72642

What is CVE-2026-72642?

A vulnerability in Elasticsearch's native inference process allows unauthorized manipulation of memory through improperly validated model offsets. This flaw occurs when a user uploads a crafted machine learning model that computes a memory address, potentially leading to heap corruption. Such corruption can crash the inference process and, with precise control over memory allocation, facilitate arbitrary code execution. This poses significant risks for applications relying on compromised inference models.

References