CVE-2026-2492

HighCVSS 7.8/10Last modified Jul 15, 2026

Description

TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of TensorFlow. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the handling of plugins. The application loads plugins from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25480.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

No affected versions have been published.

Timeline

Published
Feb 20, 2026
Last modified
Jul 15, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-249205.5Permission control vulnerability in the AMS module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-249217.1Address read vulnerability in the HDC module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiaCVE-2026-249225.5Buffer overflow vulnerability in the HDC module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-249235.5Permission control vulnerability in the HDC module. Impact: Successful exploitation of this vulnerability may affect service confidentialityCVE-2026-249245.5Vulnerability of improper permission control in the print module. Impact: Successful exploitation of this vulnerability may affect service cCVE-2026-249255.5Heap-based buffer overflow vulnerability in the image module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-249265.5Out-of-bounds write vulnerability in the camera module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-249275.5Out-of-bounds access vulnerability in the frequency modulation module. Impact: Successful exploitation of this vulnerability may affect avaiCVE-2026-249285.5Out-of-bounds write vulnerability in the file system module. Impact: Successful exploitation of this vulnerability may affect service confidCVE-2026-249294.4Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-24937.5IceWarp collaboration Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensiCVE-2026-249305.5UAF concurrency vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability.