{"id":"CVE-2026-56440","kind":"vulnerability","aliases":["CVE-2026-56440"],"related":[],"title":"BigDL: input validation flaw lets a local user escalate privilege","description":"Improper input validation for some BigDL before version 2.5.0b1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.","summary":"BigDL versions before 2.5.0b1 have an input validation flaw in user applications running in Ring 3. A local, unprivileged software adversary can use it to escalate privileges, and the sources describe only low impact to confidentiality, integrity and availability.","severity":"medium","cvss":4.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bigdl","machine-learning","package","python"],"not_affected_if":["bigdl-2.5.0b1-or-later"],"how_to_check":"- Check the installed BigDL version with `pip show bigdl` or the version pinned in your requirements file","fix":"- BigDL: `2.5.0b1`","status":"open","published_at":"2026-11-10T18:17:41+00:00","first_seen_at":"2026-11-10T18:22:59+00:00","triaged_at":"2026-11-10T18:26:30+00:00","updated_at":"2026-11-10T18:26:30+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-10T18:26:30Z","model":"claude-haiku-5-5","output":{"fix":"- BigDL: `2.5.0b1`","reach":"local","title":"BigDL: input validation flaw lets a local user escalate privilege","impact":"medium","summary":"BigDL versions before 2.5.0b1 have an input validation flaw in user applications running in Ring 3. A local, unprivileged software adversary can use it to escalate privileges, and the sources describe only low impact to confidentiality, integrity and availability.","audience":"developers","category":"package","nicknames":[],"who_cares":["bigdl","python","machine-learning"],"confidence":0.5,"fix_status":"available","needs_auth":"yes","worst_case":"local user gains elevated privileges on the host","analyst_note":"Confirm the affected BigDL package ecosystem and the exact vulnerable component and attack path from the vendor advisory; the NVD entry gives only the CVSS description.","how_to_check":"- Check the installed BigDL version with `pip show bigdl` or the version pinned in your requirements file\n- unknown otherwise","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["bigdl-2.5.0b1-or-later"],"who_is_affected":"Teams running BigDL versions before 2.5.0b1 where untrusted local software or users can reach the application. The sources do not describe the exact data path or configuration that makes it exploitable. Teams not running BigDL can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000724,"input_tokens":4652,"output_tokens":517,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-56440':13A,16A '2.5.0':26B,71C '3':39B,75C 'access':109C 'activ':122C 'adversari':44B,86C 'allow':79C 'applic':35B,77C 'attack':96C,111C 'avail':62B,136C,151C 'b1':27B,72C 'bigdl':1A,17B,23B,68C 'combin':91C 'complex':95C 'confidenti':59B,131C,146C 'cve':11A,14A 'describ':54B 'enabl':98C 'escal':9A,49B,81C,99C 'flaw':4A,32B 'impact':57B,129C,153C 'improp':63C 'input':2A,30B,64C 'integr':60B,133C,148C 'interact':124C 'intern':118C 'knowledg':119C 'learn':20B 'let':5A 'local':7A,41B,108C 'low':56B,94C,132C,134C,137C 'machin':19B 'machine-learn':18B 'may':78C,97C,104C,128C 'none':147C,149C,152C 'occur':106C 'packag':21B 'potenti':105C,126C 'present':115C 'privileg':10A,50B,83C,101C 'python':22B 'requir':112C,121C 'result':103C,142C 'ring':38B,74C 'run':36B 'softwar':43B,85C 'sourc':53B 'special':117C 'subsequ':144C 'system':141C,145C 'unauthent':89C 'unprivileg':42B,84C 'use':46B 'user':8A,34B,76C,90C,123C 'valid':3A,31B,65C 'version':24B,70C 'via':107C 'vulner':127C,140C 'within':73C 'without':116C","nicknames":[],"mitigations":[],"who_affected":"Teams running BigDL versions before 2.5.0b1 where untrusted local software or users can reach the application. The sources do not describe the exact data path or configuration that makes it exploitable. Teams not running BigDL can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bigdl","machinelearning","medium","package","python"],"campaign_type":null,"search_a":"'-2026':12A,15A '-56440':13A,16A 'bigdl':1A 'cve':11A,14A 'escal':9A 'flaw':4A 'input':2A 'let':5A 'local':7A 'privileg':10A 'user':8A 'valid':3A","search_b":"'2.5.0':26B '3':39B 'adversari':44B 'applic':35B 'avail':62B 'b1':27B 'bigdl':17B,23B 'confidenti':59B 'describ':54B 'escal':49B 'flaw':32B 'impact':57B 'input':30B 'integr':60B 'learn':20B 'local':41B 'low':56B 'machin':19B 'machine-learn':18B 'packag':21B 'privileg':50B 'python':22B 'ring':38B 'run':36B 'softwar':43B 'sourc':53B 'unprivileg':42B 'use':46B 'user':34B 'valid':31B 'version':24B","search_c":"'2.5.0':71C '3':75C 'access':109C 'activ':122C 'adversari':86C 'allow':79C 'applic':77C 'attack':96C,111C 'avail':136C,151C 'b1':72C 'bigdl':68C 'combin':91C 'complex':95C 'confidenti':131C,146C 'enabl':98C 'escal':81C,99C 'impact':129C,153C 'improp':63C 'input':64C 'integr':133C,148C 'interact':124C 'intern':118C 'knowledg':119C 'local':108C 'low':94C,132C,134C,137C 'may':78C,97C,104C,128C 'none':147C,149C,152C 'occur':106C 'potenti':105C,126C 'present':115C 'privileg':83C,101C 'requir':112C,121C 'result':103C,142C 'ring':74C 'softwar':85C 'special':117C 'subsequ':144C 'system':141C,145C 'unauthent':89C 'unprivileg':84C 'user':76C,90C,123C 'valid':65C 'version':70C 'via':107C 'vulner':127C,140C 'within':73C 'without':116C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T18:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"secure@intel.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-56440","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56440","severity":null,"published_at":"2026-11-10T18:17:41+00:00","modified_at":"2026-11-10T18:17:41+00:00","first_seen_at":"2026-11-10T18:22:59+00:00","fetched_at":"2026-11-10T18:22:59+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}