Intel BigDL: Escalation of privilege via improper input validation
Summary
Improper input validation in BigDL versions before 2.5.0b1 can allow a local, unprivileged user to escalate privileges within Ring 3 user applications. The attack needs low complexity and an active user interaction, such as opening a crafted file or running untrusted code. Impact on the vulnerable system is rated low for confidentiality, integrity and availability, with no impact on subsequent systems. Intel has discontinued BigDL and will not release a fix.
Affected
- BigDL before version 2.5.0b1 (per CNA record)
- Intel advisory INTEL-SA-01553 lists all BigDL versions as affected
- CVSS 4.0: 4.6 (Medium), vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Fixed in
- No fixed version. Intel is not releasing updates; BigDL is discontinued.
- The 2.5.0b1 boundary in the CNA record is not a released fix.
Workaround
- Uninstall BigDL or stop using it, as recommended by Intel.
- If removal is delayed, limit local access to trusted users and monitor for vendor updates (generic advice from a third-party tracker, not from Intel).
- Teams that still need the code may create their own fork; this is a migration decision, not a mitigation.
Exploitation
- Not listed in CISA KEV.
- Third-party trackers report no known exploitation in the wild and no public exploit code.
- NVD analysis is still pending. Confidence is low because the record is very recent.
Our recommendation
- Search for BigDL in Python environments, Maven/Spark packages, containers and notebook images.
- Uninstall BigDL or stop its use, and remove leftover dependencies, including transitive ones such as opennlp-tools (verify in the dependency tree).
- Handle CVE-2026-52899 in the same removal. It is a network-reachable deserialization flaw in the same advisory and is more concerning.
- Re-check the NVD entry and the Intel advisory for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Intel Security Advisory INTEL-SA-01553 intel.com
- OpenCVE: CVE-2026-56440 app.opencve.io
- OpenCVE: CVE-2026-52899 app.opencve.io
- Strix: CVE-2026-56440 www.strix.ai
- SecurityWeek: Intel and AMD patch Tuesday www.securityweek.com
- Phoronix: Intel ending BigDL www.phoronix.com
- BigDL GitHub repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 21:07.
Original description (NVD)
Improper input validation for some BigDL before version 2.5.0b1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.