CVE-2026-34175

Executive Summary

CVE-2026-34175 is a local privilege-escalation vulnerability in Hardware-Aware-Automated-MachineLearning (HAML), an automated machine-learning toolchain. An uncontrolled search path element (CWE-427) allows an unprivileged local attacker to intercept library or module loading when a privileged user launches the application, resulting in high confidentiality, integrity, and availability impact on the affected host. No verified patch is currently available, no public exploit has been confirmed, and the CVE is not listed in CISA KEV.

Technical Analysis

The vulnerability is rooted in CWE-427 (Uncontrolled Search Path Element). The affected component of Hardware-Aware-Automated-MachineLearning resolves native libraries, helper binaries, or dynamically loaded modules through a search path whose order or membership contains locations that an unprivileged local adversary can influence. The NVD description explicitly places the flaw "within Ring 3: User Applications," meaning the vulnerable load occurs entirely in user mode rather than in the kernel or a privileged driver context.

The attack mechanism follows the classic search-order hijacking pattern:

1. The application, when started by a privileged user, resolves a library or executable by name rather than by a fully qualified, validated absolute path.
2. The search path includes directories that are writable by lower-privileged users — for example, the current working directory, per-user temporary directories, or directories appended through environment variables (e.g., PATH, LD_LIBRARY_PATH, PYTHONPATH) — that are searched before trusted system or application directories.
3. An unprivileged adversary pre-places a malicious library or executable using the expected name in one of those early-searched locations.
4. When the privileged user executes the application (passive user interaction), the operating system's loader or the application's module resolver binds to the attacker-controlled payload, executing it in the context of the victim user.

The NVD description states the attack is "low complexity," requires "passive user interaction," occurs via "local access," and does not require "special internal knowledge." This indicates the attacker does not need to reverse-engineer internal APIs; the vulnerable search path behavior is externally observable or broadly exploitable (e.g., the working directory is searched implicitly). The phrase "unprivileged software adversary with a privileged user" describes a two-party condition: a low-privilege attacker on the host and a higher-privilege victim who legitimately uses the software.

Impact claims from the NVD: confidentiality, integrity, and availability of the vulnerable system are each rated high; the subsequent/system-level confidentiality, integrity, and availability impacts are rated none. This suggests the damage is confined to the host running the application and the user context in which the app executes, with no demonstrated pivot to backend systems.

Important data limitations: the vendor has not published a versioned release identifier (the description uses "NA" and a commit hash 45cd723), the CVSS vector is not assigned (N/A), and patch evidence from tracked sources is absent (confidence 0/4). No public technical write-up or PoC code is currently available, so the code-level specifics of which loader API or module-resolution function is vulnerable cannot be confirmed from the provided data.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class (CWE-427 — uncontrolled search path) and the NVD description. No public PoC is available; the steps describe the class-level mechanism rather than confirmed implementation details.

1. Reconnaissance / target identification. The attacker already has unprivileged local access to a host — for example, a shared workstation, a container, or a machine where low-privilege service accounts exist. The attacker identifies that a privileged user (e.g., an administrator, a data-science team member, or a scheduled task account) executes Hardware-Aware-AutoML. This can be inferred from process listings, scheduled tasks, shortcut files, shell history, or observable application artifacts.

2. Triggering the flaw. The attacker determines which directories participate in the application's search path and which library/helper names are resolved dynamically without a fully qualified path. Because no special internal knowledge is required, the attacker can rely on standard loader behavior: for example, many applications resolve DLLs from the current working directory, the application directory, or user-controlled environment variables before falling back to system directories. The attacker writes a malicious payload — a PE DLL on Windows, a shared object on Linux — into one of these early-searched, attacker-writable locations, using the expected base name.

3. Payload / execution method. On the next occasion when the privileged user launches the affected application, the loader resolves the library/helper to the attacker-controlled file. The payload executes in the victim user's security context at Ring 3 (user mode). No elevation of the kernel is required because the compromise is achieved at the user-application privilege boundary: the unprivileged attacker gains the privileges of the victim user running HAML.

4. Post-exploitation impact. Code execution in the victim's context gives the attacker access to whatever the victim user can access: credentials and tokens, configuration files, training datasets, model artifacts, and project source code. The attacker can tamper with machine-learning models or training pipelines (integrity impact), exfiltrate or encrypt sensitive research data (confidentiality/availability impact), and establish persistence, for example by modifying application startup scripts or libraries. According to the NVD, subsequent system-level impacts are none, so blast radius is generally confined to the compromised host and the victim account.

Given the local-only attack vector and required user interaction, this vulnerability is most realistic in shared compute environments, CI/CD build agents, or developer workstations where multiple privilege levels coexist. No evidence of in-the-wild exploitation or threat-actor campaigns is available as of this report.

Impact Assessment

• Attack vector and preconditions: local access; an unprivileged adversary; a privileged user who passively runs the vulnerable application; low complexity; no special internal knowledge required. The requirement for passive user interaction reduces the likelihood of silent, automated exploitation.
• Technical impact: escalation of privilege from an unprivileged local account to the privilege level of the user executing HAML. NVD rates confidentiality, integrity, and availability impact on the vulnerable system as high and subsequent system impact as none.
• Business impact: in machine-learning engineering environments, a successful exploit can lead to theft or manipulation of proprietary datasets, poisoning of models and training pipelines, disclosure of credentials, and disruption of automation jobs. If the privileged user is a domain administrator or a highly privileged service account, the practical impact may extend to broader AD/network compromise — although the NVD assigns no downstream system impact, defenders should treat host compromise as a potential foothold.
• CVSS / EPSS context: no CVSS vector has been assigned (N/A), which complicates risk scoring. The EPSS score is 0.00154 (5.1 percentile), indicating a low modeled probability of exploitation in the wild. CISA KEV does not list this CVE.
• Patch status: zero of four tracked sources report patch evidence. The absence of a verifiable fix means vulnerable deployments remain exposed until maintainers publish a release containing commit 45cd723 (referenced by the NVD description) or an equivalent remediation.

Detection Guidance

Because this is a local, host-level flaw, detection should focus on endpoint telemetry: suspicious library loads, environment-variable manipulation, and file creation in user-writable paths. The rules below are class-level detections; replace the placeholder application/executable identifiers with the local deployment values for Hardware-Aware-AutoML where noted.

Sigma Rule

title: Suspicious Library Load from User-Writable Path - CVE-2026-34175
id: 5d2e6c9a-3417-5c75-9d3a-000000000000
status: experimental
description: >
  Detects native library loads from attacker-writable directories (current user temp,
  public user directories, or Downloads) by processes that host
  Hardware-Aware-Automated-MachineLearning. Exploitation of CVE-2026-34175 relies on
  an uncontrolled search path (CWE-427). Tailor the 'Image' filter to the
  application/interpreter used to run the product in your environment.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-34175
  - https://cwe.mitre.org/data/definitions/427.html
tags:
  - attack.privilege_escalation
  - attack.t1574.001
logsource:
  product: windows
  category: image_load
detection:
  selection:
    ImageLoaded|startswith:
      - 'C:\Users\*\AppData\Local\Temp\'
      - 'C:\Users\Public\'
      - 'C:\Users\*\Downloads\'
  filter_known_good:
    ImageLoaded|startswith:
      - 'C:\Windows\'
      - 'C:\Program Files\'
      - 'C:\Program Files (x86)\'
  condition: selection and not filter_known_good
falsepositives:
  - Legitimate applications that ship DLLs from per-user directories (tune based on
    the application's normal load behavior)
level: high

YARA Rule

rule CVE_2026_34175_HAML_SearchPath_Hijack_Payload
{
    meta:
        author      = "ValtersIT Threat Intelligence"
        description = "Detects PE (DLL) files planted for uncontrolled search path hijacking targeting Hardware-Aware-Automated-MachineLearning (CVE-2026-34175, CWE-427)."
        cve         = "2026-34175"
        cwe         = "CWE-427"
        mitre       = "T1574.001"
        tlp         = "WHITE"

    strings:
        $s_product = "Hardware-Aware-Automated-MachineLearning" ascii wide nocase
        $s_abbrev  = "Hardware-Aware-AutoML" ascii wide nocase
        $mz        = { 4D 5A }

    condition:
        $mz at 0 and
        (
            #s_product >= 1 or
            #s_abbrev >= 1
        ) and
        filesize < 10MB
}

The rule is intentionally conservative: it flags PE (or PE-derived) payloads that embed the product's name/string. Analysts should supplement it with file-hash or authenticity screening (e.g., signature checks) to reduce false positives.

Suricata IDS Rule

This vulnerability is triggered locally; network detection is secondary. The rule below detects delivery of suspicious PE DLL downloads that may carry the hijacking payload into an organization (e.g., via staging sites or tooling downloads).

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-34175 - Suspicious PE DLL Download (HAML Search-Path Payload Delivery)"; flow:established,to_client; file.magic:"PE32 executable"; fileext:"dll"; http.user_agent; classtype:attempted-user; reference:cve,2026-34175; sid:202634175; rev:1;)

Note: this rule detects a delivery artifact, not the local hijack itself. Host-based detection (Sigma/EDR and the Wazuh/Splunk/Elastic queries below) is the primary detection surface for CVE-2026-34175.

Elastic Detection

EQL query for DLL load events originating from attacker-writable paths, using Elastic Endpoint/Windows event data:

sequence by host.name, process.executable with maxspan=1m
  [ file where event.action == "creation" and
      file.path : ("C:\\Users\\*\\AppData\\Local\\Temp\\*.dll",
                   "C:\\Users\\Public\\*.dll",
                   "C:\\Users\\*\\Downloads\\*.dll") ]
  [ dll where event.action == "load" and
      dll.path : ("C:\\Users\\*\\AppData\\Local\\Temp\\*.dll",
                  "C:\\Users\\Public\\*.dll",
                  "C:\\Users\\*\\Downloads\\*.dll") and
      not dll.path : ("C:\\Windows\\*", "C:\\Program Files\\*") ]

This sequence correlates a suspicious DLL being created and then loaded by a process within one minute. Adjust the directory patterns to match the monitored host's policy and the product's normal behavior.

Splunk SPL Query

Sysmon-based SPL (EventCode 7 — image loaded), tuned to the HAML process if its executable name is known in the environment:

index=sysmon EventCode=7
  (ImageLoaded="C:\\Users\\Public\\*" OR
   ImageLoaded="C:\\Users\\*\\AppData\\Local\\Temp\\*.dll" OR
   ImageLoaded="C:\\Users\\*\\Downloads\\*.dll")
  NOT (ImageLoaded="C:\\Windows\\*" OR ImageLoaded="C:\\Program Files\\*")
| stats count min(_time) max(_time) values(ImageLoaded) as LoadedDlls
        by host, Image, User
| where count > 3
| rename Image as "ProcessImage", User as "Account"
| sort - count

Complementary query for environment-variable-based search-path manipulation at process start (relevant on Linux and Windows hosts):

index=sysmon EventCode=1
  (CommandLine="*LD_PRELOAD=*" OR
   CommandLine="*LD_LIBRARY_PATH=*" OR
   CommandLine="*PYTHONPATH=*")
| stats values(CommandLine) by host, User, ParentImage, Image

Focus on cases where the launching process is not the user's standard shell/IDE and where the path value points to a user-writable directory.

Wazuh OSSEC Rule

The following local Wazuh rule watches Sysmon image-load events (EventID 7) for the same attacker-writable path patterns:

<group name="windows,sysmon,">
  <rule id="100341" level="12">
    <if_sid>92000</if_sid>
    <field name="win.system.eventID">^7$</field>
    <regex>win.eventdata.imageLoaded=(\.*\\AppData\\Local\\Temp\\|\.*\\Users\\Public\\|\.*\\Users\\.*\\Downloads\\).*\.dll</regex>
    <description>CVE-2026-34175: Suspicious DLL loaded from user-writable path (Hardware-Aware-AutoML uncontrolled search path)</description>
    <mitre>
      <id>T1574.001</id>
    </mitre>
  </rule>
</group>

Note: verify that rule ID 100341 does not conflict with existing local rules, and confirm the if_sid parent (here assumed to be the Sysmon event group header, typically 92000 in the Wazuh ruleset) matches the deployed Sysmon decoder configuration. Adjust the regex if the decoder emits ImageLoaded with different field casing.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor advisory, hotfix, or release candidate has been confirmed by any tracked source. The NVD description names commit 45cd723 as the version that resolves the issue; however, this has not been verified against vendor release channels, and no CVE metadata links to a downloadable patch.

1. Immediate mitigations (no patch available):

• Launch Hardware-Aware-AutoML only from trusted working directories. Remove user-writable directories from the application's search path (e.g., prune PATH, LD_LIBRARY_PATH, LD_PRELOAD, PYTHONPATH, and the Windows current-directory search behavior).
• Enforce least privilege: run HAML jobs under a dedicated, non-administrative service account rather than an interactive administrator or domain-privileged account.
• Restrict write permissions on all directories that appear in the loader search path (application directory, temp directories, per-user directories) so unprivileged users cannot plant payloads.
• Enable and tune EDR/Sysmon alerts for suspicious DLL loads and environment-variable manipulation (see Detection Guidance).
• Review scheduled tasks and job runners that invoke the product; ensure they use absolute paths and hardened environment variables.

2. Patch / upgrade steps:

• Contact the project maintainers for an official release containing commit 45cd723 (the NVD-referenced fix).
• When a release is available, upgrade all deployments and verify integrity via published checksums/hashes.
• Until then, treat any deployment of the product as vulnerable and apply compensating controls.

3. Long-term hardening:

• Vendors should implement fully qualified path resolution for all dynamically loaded libraries/executables, validate module integrity (e.g., code signing or hash checks), and remove reliance on implicit search-path behaviors.
• Deploy application allowlisting (AppLocker / Windows Defender Application Control, or equivalent Linux mandatory access control) to block unsigned or unexpected DLLs from loading.
• Establish a file-integrity baseline for product directories and alert on new or modified library files.
• Educate users: prompt them to avoid launching the application from untrusted directories (e.g., e-mail-attachment folders, shared drives) and to report abnormal startup behavior.

References

1. NVD Entry — CVE-2026-34175: https://nvd.nist.gov/vuln/detail/CVE-2026-34175
2. MITRE CWE-427 — Uncontrolled Search Path Element: https://cwe.mitre.org/data/definitions/427.html
3. MITRE ATT&CK — T1574.001 Hijack Execution Flow: DLL Search Order Hijacking: https://attack.mitre.org/techniques/T1574/001/
4. FIRST EPSS — CVE-2026-34175 scoring context: https://www.first.org/epss/
5. CISA Known Exploited Vulnerabilities Catalog (CVE not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat-actor / in-the-wild status: No known threat-actor campaigns, exploit-in-the-wild evidence, or public PoC code is associated with CVE-2026-34175 at the time of writing. CISA KEV status: NO. PoC status: UNKNOWN (no public proof-of-concept identified). This assessment may change if the NVD description's referenced fix commit (45cd723) is subsequently published with technical details or a researcher releases an analysis.