CVE-2026-35502 in Extension for PyTorch
Summary
by MITRE • 08/12/2026
Deserialization of untrusted data for some Intel(R) Extension for PyTorch before version 2.8.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability represents a critical deserialization flaw in Intel's Extension for PyTorch software version 2.8.0 and earlier, operating within ring 3 user application contexts. The issue stems from improper validation of untrusted data during the deserialization process, creating a potential privilege escalation vector that could be exploited by unprivileged adversaries. The vulnerability specifically affects systems where the Intel PyTorch extension is installed as a user-level application component, making it accessible to any local user with minimal attack prerequisites. Attackers can leverage this weakness through local access methods without requiring authentication or special internal knowledge, though they must engage in active user interaction to execute the exploit successfully.
The technical nature of this vulnerability aligns with common CWE classifications related to insecure deserialization patterns, where maliciously crafted data structures can be processed by the application and executed as code within the target environment. The attack complexity is rated as low, indicating that exploitation requires minimal skill and resources, while the attack requirements are considered non-special, meaning standard local user accounts can potentially leverage this vulnerability. This flaw operates at the application layer rather than system kernel level, yet its potential impact extends beyond simple data corruption to enable privilege escalation within the user context.
The operational implications of this vulnerability span across all three core security principles of confidentiality, integrity, and availability, though with low severity ratings for each individual aspect. However, the cumulative effect can result in significant downstream impacts including complete system compromise with no protection against confidentiality breaches, integrity violations, or availability disruptions. The vulnerability creates a pathway where an unprivileged user could potentially gain elevated privileges within the system, effectively undermining the security model of the targeted environment. This type of vulnerability commonly maps to ATT&CK technique T1068 which covers 'Exploitation for Privilege Escalation' and represents a critical gap in software security validation.
Mitigation strategies should focus on immediate patching of the Intel PyTorch extension to version 2.8.0 or later, where the deserialization vulnerability has been addressed. System administrators should also implement additional controls including restricting local access privileges for users who do not require full system access, monitoring for suspicious deserialization activities, and applying principle of least privilege configurations. Organizations should conduct thorough security assessments of all installed PyTorch extensions and related software components to identify similar vulnerabilities in their environment. Network segmentation and user activity monitoring can help detect exploitation attempts, while regular security updates and vulnerability management processes should be enforced across all system components to prevent similar issues from occurring in the future. The vulnerability demonstrates the importance of input validation and secure coding practices specifically when handling serialized data within application frameworks.