TensorFlow CVE-2026-2492
HIGHSeverity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local search-path hijack requires existing low-privileged code execution (AV:L, PR:L) with no user interaction and low complexity, yielding full code execution and thus high C/I/A.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
Lifecycle Timeline
8DescriptionCVE.org
TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of TensorFlow. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of plugins. The application loads plugins from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25480.
AnalysisAI
Local privilege escalation in TensorFlow's HDF5 plugin-loading mechanism lets a low-privileged user run arbitrary code as a higher-privileged target user. The flaw stems from TensorFlow loading plugins from an unsecured, attacker-writable search-path location (CWE-427), so an attacker who can already execute low-privileged code plants a malicious plugin that is later loaded in the victim's context. There is no public exploit identified at time of analysis, EPSS risk is very low (0.02%), and it is not listed in CISA KEV, but the issue is credibly reported by Trend Micro ZDI (ZDI-26-116) and patched by upstream and Red Hat.
Technical ContextAI
The vulnerability is a CWE-427 Uncontrolled Search Path Element in TensorFlow's dynamic plugin/HDF5 library loading. TensorFlow extends functionality through dynamically loaded shared-library plugins (e.g., HDF5/file-system and op plugins) that are resolved at runtime from filesystem search paths. When one of those search-path entries points to a location that lower-privileged users can write to, the loader will pick up an attacker-supplied library instead of the legitimate one, executing attacker code inside the loading process. This is the same class of weakness as DLL/.so search-order hijacking: trust is misplaced in a writable directory that participates in dynamic resolution. The affected component is the TensorFlow runtime as packaged across platforms; Red Hat ships TensorFlow such that RHSA-2026:10184 and the corresponding VEX (cve-2026-2492.json) enumerate the precise affected RPMs.
Affected ProductsAI
TensorFlow is the affected product; the input does not specify exact upstream version ranges, and affected versions should be taken from the vendor data rather than inferred. Red Hat confirms impact and provides fixed packages via RHSA-2026:10184 (https://access.redhat.com/errata/RHSA-2026:10184), with per-component status in the CSAF VEX (https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2492.json) and tracking in Bugzilla 2441510 (https://bugzilla.redhat.com/show_bug.cgi?id=2441510). The upstream fix is in TensorFlow commit 46e7f7fb144fd11cf6d17c23dd47620328d77082 (https://github.com/tensorflow/tensorflow/commit/46e7f7fb144fd11cf6d17c23dd47620328d77082), and the original advisory is ZDI-26-116 (https://www.zerodayinitiative.com/advisories/ZDI-26-116/). No CPE strings were provided in the input.
RemediationAI
Apply the vendor patch: on Red Hat systems, update the affected TensorFlow packages per RHSA-2026:10184 (https://access.redhat.com/errata/RHSA-2026:10184); for source/upstream builds, apply or rebuild against TensorFlow commit 46e7f7fb144fd11cf6d17c23dd47620328d77082. A released, version-tagged upstream patched release is not independently confirmed from the input, so the upstream fix should be treated as a commit-level fix pending a tagged release. Until patched, reduce exposure by ensuring no plugin/library search-path directory used by TensorFlow is writable by non-privileged users - audit and tighten directory permissions (e.g., remove world/group-write on plugin and HDF5 load paths), and avoid running TensorFlow processes that other users can influence. Where feasible, run TensorFlow under a dedicated, isolated service account and avoid invoking it from world-writable working directories; the trade-off is operational friction for shared ML environments and possible breakage of legitimate custom-plugin workflows that relied on the loose load path. Consult ZDI-26-116 and the Red Hat VEX for component-specific guidance.
Same weakness CWE-427 – Uncontrolled Search Path Element
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today