The vulnerability arises when the native inference process used by Elasticsearch to evaluate machine learning models accepts an offset supplied inside the model and computes a memory address without verifying that the offset remains within the bounds of the underlying storage. A model operator with the permissions needed to upload and deploy a trained model can craft an offset that causes the process to read or write memory outside its intended allocation. This heap corruption can crash the inference process, and with enough control over the heap layout, may enable arbitrary code execution in the context of that process.

Products affected are Elastic:Elasticsearch. No specific version range is provided in the official data, but the vulnerability is relevant to deployments that allow uploading and deploying custom machine learning models.

The CVSS score of 8.8 indicates a high severity, while the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, and no public exploit has been reported. An attacker would need privileges to upload a model, which means the attack surface is limited to trusted users or environments with misconfigured permissions. If the inference process runs with elevated privileges, arbitrary code execution could potentially lead to a full cluster compromise.