Elasticsearch ML Out-of-Bounds Pointer CVE-2026-72642 Security Update

Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-123) Vulnerability Overview Vulnerability Name: Out-of-bounds pointer offset in Elasticsearch machine learning native inference Vulnerability Description: The inference process used by Elasticsearch to evaluate uploaded machine learning models accepts a model operation that calculates memory addresses from offsets provided internally by the model, without verifying that the offsets remain within the bounds of the underlying storage. A user with permissions required to upload and deploy trained models can create a model that reads and writes memory outside the expected allocation. The result is heap corruption, causing the inference process to crash, and, if heap layout is sufficiently controllable, potentially allowing arbitrary code execution in the context of the process. Scope of Impact Affected Versions: - All versions from 8.19.0 to 8.19.19 - All versions from 9.4.0 to 9.4.4 - Version 9.5.0 Affected Configurations: - Elasticsearch deployments running an affected version with machine learning enabled, and with at least one machine learning node available Remediation Solution and Mitigations: - This issue is resolved in Elasticsearch versions 8.19.20, 9.4.5, and 9.5.1. For users who cannot upgrade: - Grant machine learning permissions for uploading and deploying trained models only to trusted administrators, and do not accept trained models from untrusted sources. - If machine learning is not needed, disable it by setting to . Note that this will remove all machine learning capabilities, including anomaly detection, data frame analytics, and inference. Additional Information Indicators of Compromise (IOC): No specific vulnerability indicators have been identified. Elastic Cloud Serverless: Due to our continuous deployment and model patching process, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless products prior to public disclosure. Severity: CVSSv3.1: High (8.8) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE ID: CVE-2026-72642 Issue Type: CWE-823 - Use of Out-of-bounds Pointer Offset

Goal Reached Thanks to every supporter — we hit 100%!

Elasticsearch ML Out-of-Bounds Pointer CVE-2026-72642 Security Update