{"id":"CVE-2026-52899","kind":"vulnerability","aliases":["CVE-2026-52899"],"related":[],"title":"BigDL: untrusted deserialization lets an unprivileged user escalate privileges","description":"Deserialization of untrusted data for some BigDL software before version 2.5.0b1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via network access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.","summary":"Some BigDL software before 2.5.0b1 deserializes untrusted data without checking it, which can let an unprivileged user escalate privileges. The description says it can be reached over the network with no user interaction and low attack complexity.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bigdl","package","python","spark"],"not_affected_if":["bigdl-2.5.0b1-or-later"],"how_to_check":"- Check the installed BigDL version (for example with `pip show bigdl` or your package manager) and see whether it is below `2.5.0b1`.\n- Look for BigDL components in your Python or Spark environments that accept serialized input from other sources.","fix":"- Move BigDL to `2.5.0b1` or later, per the NVD description.","status":"open","published_at":"2026-11-10T18:17:40+00:00","first_seen_at":"2026-11-10T18:22:58+00:00","triaged_at":"2026-11-10T18:24:39+00:00","updated_at":"2026-11-10T18:24:39+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-10T18:24:39Z","model":"claude-haiku-5-5","output":{"fix":"- Move BigDL to `2.5.0b1` or later, per the NVD description.","reach":"network","title":"BigDL: untrusted deserialization lets an unprivileged user escalate privileges","impact":"high","summary":"Some BigDL software before 2.5.0b1 deserializes untrusted data without checking it, which can let an unprivileged user escalate privileges. The description says it can be reached over the network with no user interaction and low attack complexity.","audience":"developers","category":"package","nicknames":[],"who_cares":["bigdl","python","spark"],"confidence":0.5,"fix_status":"available","needs_auth":"yes","worst_case":"unprivileged user escalates privileges on the affected system","analyst_note":"Check the NVD entry and the BigDL project advisory for which packages and components are affected and whether the fix is a release or a patch.","how_to_check":"- Check the installed BigDL version (for example with `pip show bigdl` or your package manager) and see whether it is below `2.5.0b1`.\n- Look for BigDL components in your Python or Spark environments that accept serialized input from other sources.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["bigdl-2.5.0b1-or-later"],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000704,"input_tokens":4660,"output_tokens":475,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-52899':12A,15A '2.5.0':24B,68C '3':72C 'access':106C 'adversari':83C 'allow':76C 'applic':74C 'attack':56B,93C,108C 'avail':133C,148C 'b1':25B,69C 'bigdl':1A,16B,21B,64C 'check':30B 'combin':88C 'complex':57B,92C 'confidenti':128C,143C 'cve':10A,13A 'data':28B,61C 'descript':41B 'deseri':3A,26B,58C 'enabl':95C 'escal':8A,38B,78C,96C 'impact':126C,150C 'integr':130C,145C 'interact':53B,121C 'intern':115C 'knowledg':116C 'let':4A,34B 'low':55B,91C,129C,131C,134C 'may':75C,94C,101C,125C 'network':49B,105C 'none':144C,146C,149C 'occur':103C 'packag':17B 'potenti':102C,123C 'present':112C 'privileg':9A,39B,80C,98C 'python':18B 'reach':46B 'requir':109C,118C 'result':100C,139C 'ring':71C 'say':42B 'softwar':22B,65C,82C 'spark':19B 'special':114C 'subsequ':141C 'system':138C,142C 'unauthent':86C 'unprivileg':6A,36B,81C 'untrust':2A,27B,60C 'user':7A,37B,52B,73C,87C,120C 'version':67C 'via':104C 'vulner':124C,137C 'within':70C 'without':29B,113C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bigdl","medium","package","python","spark"],"campaign_type":null,"search_a":"'-2026':11A,14A '-52899':12A,15A 'bigdl':1A 'cve':10A,13A 'deseri':3A 'escal':8A 'let':4A 'privileg':9A 'unprivileg':6A 'untrust':2A 'user':7A","search_b":"'2.5.0':24B 'attack':56B 'b1':25B 'bigdl':16B,21B 'check':30B 'complex':57B 'data':28B 'descript':41B 'deseri':26B 'escal':38B 'interact':53B 'let':34B 'low':55B 'network':49B 'packag':17B 'privileg':39B 'python':18B 'reach':46B 'say':42B 'softwar':22B 'spark':19B 'unprivileg':36B 'untrust':27B 'user':37B,52B 'without':29B","search_c":"'2.5.0':68C '3':72C 'access':106C 'adversari':83C 'allow':76C 'applic':74C 'attack':93C,108C 'avail':133C,148C 'b1':69C 'bigdl':64C 'combin':88C 'complex':92C 'confidenti':128C,143C 'data':61C 'deseri':58C 'enabl':95C 'escal':78C,96C 'impact':126C,150C 'integr':130C,145C 'interact':121C 'intern':115C 'knowledg':116C 'low':91C,129C,131C,134C 'may':75C,94C,101C,125C 'network':105C 'none':144C,146C,149C 'occur':103C 'potenti':102C,123C 'present':112C 'privileg':80C,98C 'requir':109C,118C 'result':100C,139C 'ring':71C 'softwar':65C,82C 'special':114C 'subsequ':141C 'system':138C,142C 'unauthent':86C 'unprivileg':81C 'untrust':60C 'user':73C,87C,120C 'version':67C 'via':104C 'vulner':124C,137C 'within':70C 'without':113C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T18:17:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"secure@intel.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-52899","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52899","severity":null,"published_at":"2026-11-10T18:17:40+00:00","modified_at":"2026-11-10T18:17:40+00:00","first_seen_at":"2026-11-10T18:22:58+00:00","fetched_at":"2026-11-10T18:22:58+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}