Executive brief
Elasticsearch's machine learning inference engine accepts uploaded model files that can reference memory addresses outside safe bounds. A trusted administrator or model provider could craft a malicious model to crash the inference process or execute arbitrary code. This affects deployments with machine learning enabled and trusted model upload capabilities.
Technical details
The vulnerability is a use-of-out-of-range pointer offset (CWE-823) in the native inference process used by Elasticsearch to evaluate uploaded machine learning models. The flaw exists in model operations that compute memory addresses from offsets supplied within the model file without validating that these offsets remain within allocated storage bounds. An authenticated user with privileges to upload and deploy trained models can craft a malicious model that performs unauthorized reads and writes to heap memory. This results in heap corruption leading to process crash (denial of service), or with careful heap layout manipulation, arbitrary code execution within the inference process context. The vulnerability requires authentication and machine learning to be enabled; patches are available in versions 8.19.20, 9.4.5, and 9.5.1.
Affected products
- Elastic Elasticsearch 8.19.0–8.19.19, 9.4.0–9.4.4, 9.5.0
Timeline
- 2026-08-13: disclosed: CVE-2026-72642 and advisory ESA-2026-123 published
- 2026-08-13: patched: Elasticsearch 8.19.20, 9.4.5, and 9.5.1 released with fix