TensorFlow CVE-2026-2492
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local code execution
-
DeliveryPlant malicious plugin in writable search-path dir
-
ExploitTensorFlow loads attacker library at runtime
-
ExecutionExecute code in privileged user context
-
ImpactEscalate privileges on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path element control
|
| Exploitation Conditions | Exploitation requires the attacker to already have the ability to execute low-privileged code on the target host (PR:L, AV:L) and requires TensorFlow's plugin/HDF5 dynamic-loading search path to include a location writable by that low-privileged user - that unsecured plugin-load directory is the concrete prerequisite. The escalation only triggers when a higher-privileged user or service then loads plugins via TensorFlow, so it depends on a multi-user/shared deployment where a privileged TensorFlow process runs after the malicious plugin is planted. No user interaction is needed (UI:N). Limiting factors: it is local-only (not remotely exploitable), it requires the search path to actually contain a writable directory (hardened/default-secure permissions defeat it), and it requires a privileged consumer of the plugin to execute. |
| Impact | Signals are largely consistent and point to a real-but-bounded local risk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local, low-complexity attack that requires the attacker to already hold low privileges (PR:L) and yields full confidentiality, integrity, and availability impact on the host - classic privilege escalation. EPSS is very low (0.02%, 3rd percentile) and the CVE is not in CISA KEV, which is expected for a local-only EoP that cannot be sprayed remotely; low EPSS here reflects the local prerequisite rather than low severity. No public exploit has been identified, and no SSVC decision data was provided in the input. Net: prioritize on multi-user or shared hosts where untrusted users can run code (build servers, ML training clusters, shared notebooks); deprioritize on single-tenant/single-user workstations where the attacker prerequisite (local code execution) already implies significant access. |
| Exploit ScenarioDerived | On a shared ML build or training host, a low-privileged user drops a malicious shared library named to match a TensorFlow plugin into an unsecured directory that TensorFlow searches at load time. When a higher-privileged user or service subsequently runs a TensorFlow workload, the planted library is loaded and the attacker's code executes in that user's context, escalating privileges. No public exploit is identified, but the local, low-complexity vector (AV:L/AC:L) makes weaponization straightforward for someone with shell access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv5 – Jun 30, 2026
Local privilege escalation in TensorFlow's HDF5 plugin-loading mechanism lets a low-privileged user run arbitrary code as a higher-privileged target user. The flaw stems from TensorFlow loading plugins from an unsecured, attacker-writable search-path location (CWE-427), so an attacker who can already execute low-privileged code plants a malicious plugin that is later loaded in the victim's context. There is no public exploit identified at time of analysis, EPSS risk is very low (0.02%), and it is not listed in CISA KEV, but the issue is credibly reported by Trend Micro ZDI (ZDI-26-116) and patched by upstream and Red Hat.
Earlier versions of this analysis (4)
Local privilege escalation in TensorFlow's HDF5 plugin-loading mechanism (CWE-427) lets a low-privileged local user load attacker-controlled plugin code from an unsecured search-path location and execute it in the context of a higher-privileged target user. Reported via Trend Micro ZDI (ZDI-26-116, ex ZDI-CAN-25480), it carries CVSS 7.8 and is fixed upstream and in Red Hat's RHSA-2026:10184; there is no public exploit identified at time of analysis and EPSS is a very low 0.02%.
Local privilege escalation in TensorFlow arises from its HDF5-related plugin loading logic searching an unsecured, attacker-writable location, enabling a low-privileged local user to plant a malicious plugin that executes arbitrary code in the context of a higher-privileged target user. The flaw was reported through Trend Micro's Zero Day Initiative (ZDI-26-116, formerly ZDI-CAN-25480) and is addressed by an upstream commit and Red Hat errata RHSA-2026:10184. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.02%, 3rd percentile), consistent with a local-only, non-wormable issue.
Local privilege escalation in TensorFlow's HDF5 plugin-loading mechanism lets a low-privileged user run arbitrary code as a higher-privileged target user (CWE-427 uncontrolled search path). TensorFlow loads HDF5/plugin libraries from an unsecured, attacker-writable location, so a planted malicious library is loaded by a privileged process. Discovered and reported through Trend Micro's Zero Day Initiative (ZDI-26-116, formerly ZDI-CAN-25480); there is no public exploit identified and EPSS is very low (0.02%, 3rd percentile), consistent with a local-only, non-internet-facing flaw.
TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of TensorFlow. [CVSS 7.0 HIGH]
RemediationAI
Apply the vendor patch: on Red Hat systems, update the affected TensorFlow packages per RHSA-2026:10184 (https://access.redhat.com/errata/RHSA-2026:10184); for source/upstream builds, apply or rebuild against TensorFlow commit 46e7f7fb144fd11cf6d17c23dd47620328d77082. A released, version-tagged upstream patched release is not independently confirmed from the input, so the upstream fix should be treated as a commit-level fix pending a tagged release. Until patched, reduce exposure by ensuring no plugin/library search-path directory used by TensorFlow is writable by non-privileged users - audit and tighten directory permissions (e.g., remove world/group-write on plugin and HDF5 load paths), and avoid running TensorFlow processes that other users can influence. Where feasible, run TensorFlow under a dedicated, isolated service account and avoid invoking it from world-writable working directories; the trade-off is operational friction for shared ML environments and possible breakage of legitimate custom-plugin workflows that relied on the loose load path. Consult ZDI-26-116 and the Red Hat VEX for component-specific guidance.
Affected ProductsAI
TensorFlow is the affected product; the input does not specify exact upstream version ranges, and affected versions should be taken from the vendor data rather than inferred. Red Hat confirms impact and provides fixed packages via RHSA-2026:10184 (https://access.redhat.com/errata/RHSA-2026:10184), with per-component status in the CSAF VEX (https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2492.json) and tracking in Bugzilla 2441510 (https://bugzilla.redhat.com/show_bug.cgi?id=2441510). The upstream fix is in TensorFlow commit 46e7f7fb144fd11cf6d17c23dd47620328d77082 (https://github.com/tensorflow/tensorflow/commit/46e7f7fb144fd11cf6d17c23dd47620328d77082), and the original advisory is ZDI-26-116 (https://www.zerodayinitiative.com/advisories/ZDI-26-116/). No CPE strings were provided in the input.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-427 Uncontrolled Search Path Element in TensorFlow's dynamic plugin/HDF5 library loading. TensorFlow extends functionality through dynamically loaded shared-library plugins (e.g., HDF5/file-system and op plugins) that are resolved at runtime from filesystem search paths. When one of those search-path entries points to a location that lower-privileged users can write to, the loader will pick up an attacker-supplied library instead of the legitimate one, executing attacker code inside the loading process. This is the same class of weakness as DLL/.so search-order hijacking: trust is misplaced in a writable directory that participates in dynamic resolution. The affected component is the TensorFlow runtime as packaged across platforms; Red Hat ships TensorFlow such that RHSA-2026:10184 and the corresponding VEX (cve-2026-2492.json) enumerate the precise affected RPMs.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local search-path hijack requires existing low-privileged code execution (AV:L, PR:L) with no user interaction and low complexity, yielding full code execution and thus high C/I/A.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
Lifecycle Timeline
6DescriptionCVE.org
TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of TensorFlow. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of plugins. The application loads plugins from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25480.
Zero Day Initiative Advisories
Executive ViewAI
TensorFlow's HDF5 plugin-loading mechanism contains a local privilege escalation vulnerability allowing low-privileged users to execute arbitrary code with higher privileges. The attack requires pre-existing system access and no public exploit currently exists, but organizations running multi-user TensorFlow environments should patch promptly given the high-severity nature of privilege escalation.
Apply vendor patch. If patch deployment is delayed, implement strict file-access controls on plugin directories, restrict TensorFlow process execution to single privilege level, and isolate TensorFlow execution in containers or VMs to limit privilege escalation scope.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB