Intel BigDL: Escalation of privilege due to protection mechanism failure
Summary
Intel's BigDL AI library contains a protection mechanism failure (CWE-693) in versions before 2.4.0 according to the CVE record. A local attacker who already has a low-privileged foothold and meets the attack requirements can escalate privileges, with high impact on confidentiality, integrity and availability of the vulnerable system. Intel has discontinued BigDL and will not release a fix, so removal is the remedy. The CVSS 4.0 base score is 5.4 (medium), and NVD analysis was still pending at the time of research.
Affected
- BigDL before version 2.4.0 according to the CVE record (default status: unaffected)
- Intel's advisory lists 'BigDL software all versions'; verify the exact scope against the Intel advisory
Fixed in
Unknown. No fixed version has been published, and Intel has discontinued BigDL without further updates.
Workaround
- Uninstall BigDL or discontinue its use, as recommended by Intel.
- Until removal, limit local access to trusted users only and monitor the host. This does not remove the flaw.
Exploitation
- Not listed in CISA KEV.
- Third-party tracker: not known to be exploited.
- Public proof of concept: unknown.
Our recommendation
- Inventory hosts for BigDL, including Python packages and Spark assemblies.
- Uninstall BigDL where it is not essential, since no patch will be released.
- Where it must remain, restrict local accounts and monitor for suspicious activity.
- Re-check the Intel advisory and NVD once analysis is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Intel Security Advisory INTEL-SA-01553 intel.com
- OpenCVE: CVE-2026-20703 app.opencve.io
- SecurityWeek: Intel and AMD Patch Tuesday www.securityweek.com
- Intel BigDL GitHub repository github.com
- OffSeq Radar: CVE-2026-20703 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:25.
Original description (NVD)
Protection mechanism failure for some BigDL before version 2.4.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.