CVE-2026-72642

Name of the Vulnerable Software and Affected Versions Elasticsearch (affected versions not specified)

Description The native inference process used to evaluate uploaded machine learning models fails to validate that a memory address offset supplied within the model remains within the bounds of the underlying storage. A user with privileges to upload and deploy trained models can craft a malicious model to read and write memory outside the intended allocation. This leads to heap corruption—a condition where memory allocated for dynamic use is corrupted—which crashes the inference process and may allow arbitrary code execution within the process context if the heap layout is sufficiently controlled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.