---
id: "CVE-2026-56440"
page: "https://infrastack.ai/live/CVE-2026-56440"
kind: "vulnerability"
aliases: ["CVE-2026-56440"]
title: "BigDL: input validation flaw lets a local user escalate privilege"
severity: "medium"
cvss: 4.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bigdl", "machine-learning", "package", "python"]
not_affected_if: ["bigdl-2.5.0b1-or-later"]
published_at: "2026-11-10T18:17:41+00:00"
first_seen_at: "2026-11-10T18:22:59+00:00"
updated_at: "2026-11-10T18:26:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56440", "first_seen_at": "2026-11-10T18:22:59+00:00"}]
exploit_sources: []
---

# BigDL: input validation flaw lets a local user escalate privilege

Link for people: https://infrastack.ai/live/CVE-2026-56440 (this .md is for agents)

BigDL versions before 2.5.0b1 have an input validation flaw in user applications running in Ring 3. A local, unprivileged software adversary can use it to escalate privileges, and the sources describe only low impact to confidentiality, integrity and availability.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed BigDL version with `pip show bigdl` or the version pinned in your requirements file

## Fix

- BigDL: `2.5.0b1`

## Timeline

- 2026-11-10T18:22:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-56440

## From the sources

Improper input validation for some BigDL before version 2.5.0b1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_