CVE-2026-35502

Executive Summary

CVE-2026-35502 is a deserialization-of-untrusted-data vulnerability (CWE-502) affecting Intel Extension for PyTorch versions prior to 2.8.0. A local, unauthenticated adversary can combine low-complexity attack techniques with an active user interaction to escalate privileges within Ring 3 (user mode) on affected systems. The impact is limited to low confidentiality, integrity, and availability loss of the vulnerable process, without downstream system-level compromise, and no in-the-wild exploitation or public PoC has been documented as of this report.

Technical Analysis

Vulnerability class. CVE-2026-35502 falls under CWE-502 (Deserialization of Untrusted Data). In this class of flaw, an application reconstructs objects from an untrusted byte stream without adequate validation of the stream's contents, integrity, or provenance. During deserialization, the reconstruction process can instantiate objects with attacker-controlled attributes and, depending on the serialization format and runtime semantics, may invoke user-controllable operations as a side effect of reconstructing the object graph. In Python-based tooling, popular serialization formats encode not only data but also references to callables; a malicious payload can therefore trigger command execution, file modification, or other arbitrary operations when the byte stream is parsed.

Affected component and context. The affected product is the Intel(R) Extension for PyTorch, an open-source library that accelerates PyTorch workloads on Intel hardware. It is commonly deployed in machine learning development environments, inference servers, and data-science workstations. The NVD description indicates the flaw exists in the extension's handling of deserialized data "before version 2.8.0," implying the fix boundary is version 2.8.0. Notably, the activity occurs "within Ring 3: User Applications," meaning the vulnerability and its exploitation are confined to the user-mode privilege layer; there is no indication of a kernel-mode component.

Attack requirements. The described threat model is narrow:

• Adversary position: unprivileged software adversary, unauthenticated — no prior credentials or special internal knowledge required.
• Access vector: local access only.
• Complexity: low.
• Precondition: active user interaction — the victim must perform an action that causes the vulnerable extension to deserialize attacker-supplied data (e.g., loading a crafted model artifact or configuration resource).
• Privilege outcome: escalation of privilege relative to the unprivileged starting state, bounded to the user-mode context of the affected process.

Mechanism. While the NVD description does not disclose specific function names, file formats, or API entry points, the vulnerability mechanism is consistent with the generic CWE-502 pattern: an attacker-supplied serialized object is loaded by the Intel Extension for PyTorch without sufficient sanitization. A crafted payload leverages deserialization gadget chains — sequences of legitimate classes whose reconstructed state yields attacker-chosen behavior — to execute commands or alter program state with the privileges of the user running the affected application. The description's assignment of low confidentiality, integrity, and availability impacts to the vulnerable system, with no subsequent system-level impacts, suggests the practical exploitation ceiling is a victim-user-level code execution or denial of service rather than kernel or full-system compromise.

Assessment of available information. The NVD description is sparse concerning implementation details: no vulnerable function names, serialization entry points, or payload structures are provided. Consequently, technical analysis here is expressed at the vulnerability-class level. Insufficient technical detail is available to map the exact code path or specific pickle-format constructs used by the affected release line.

Exploitation Scenarios

No public PoC or exploit code is documented for CVE-2026-35502 at the time of writing. The attack chain below is inferred strictly from the vulnerability class (CWE-502) and the constraints stated in the NVD description (local access, low complexity, user interaction, unprivileged attacker).

Step 1 — Reconnaissance / target identification. The attacker identifies a system running an affected Intel Extension for PyTorch build (version < 2.8.0). Candidates include ML engineers' workstations, shared training/inference nodes, or CI pipelines that use the extension. Because exploitation is local and unauthenticated, the attacker only needs a foothold as an unprivileged local user on the target, or the ability to deliver a malicious file to a victim on that host.

Step 2 — Delivery and flaw trigger. The attacker crafts a malicious serialized object and delivers it via channels appropriate to local, user-interaction-driven scenarios: a poisoned model checkpoint or data artifact placed on a shared drive, delivered by email attachment, or planted in a project repository the victim clones. The victim then opens or loads this artifact in a workflow that invokes the affected extension's deserialization path — the required "active user interaction."

Step 3 — Payload execution. At the vulnerability-class level, the payload leverages a deserialization gadget chain. Because the extension processes the untrusted stream in the user's session context, reconstruction of malicious objects can invoke attacker-selected system commands or mutate in-memory application state. The NVD description's low integrity/availability impact indicates the achieved execution is constrained but real — sufficient for privilege escalation from an unprivileged state to the victim user's privilege level.

Step 4 — Post-exploitation impact. Post-exploitation is limited to the Ring 3 context: the attacker gains the victim's user-level rights on the affected application and host. Practical outcomes include reading user-accessible data (confidentiality: low), tampering with ML artifacts or configuration (integrity: low), and disrupting the user's workloads or sessions (availability: low). The description explicitly assigns no subsequent system-level confidentiality, integrity, or availability impacts, indicating no bootstrap to higher privilege domains is expected from this flaw alone.

Reporting caveat. No public PoC is available; the attack chain is inferred from the vulnerability class and may not reflect the exact exploitation mechanics of the underlying bug.

Impact Assessment

Business impact. CVE-2026-35502 affects Intel Extension for PyTorch deployments, which typically reside in data-science and ML-engineering environments. Although the described impact is bounded — low confidentiality, low integrity, low availability to the vulnerable system, and no downstream system impacts — the privilege-escalation outcome is operationally significant because ML workstations often hold valuable artifacts: model weights, training datasets, experiment logs, and credentials cached in user sessions. A successful local escalation to the victim user's context could enable lateral movement or targeted theft of these assets in subsequent stages.

Affected systems. All deployments of Intel Extension for PyTorch prior to 2.8.0, where local untrusted users can interact with the host, are theoretically in scope. Patch confidence is rated 0/4 (UNPATCHED): no tracked source confirms a vendor patch, workaround, or vendor fix as of this report. The NVD description's reference to "before version 2.8.0" implies the corrected release is 2.8.0, but enterprise teams should not treat this as a confirmed vendor advisory.

Blast radius. The blast radius is constrained by three factors: (1) the local-only access vector, (2) the requirement for active user interaction, and (3) the low severity ceiling described in the NVD text. CVSS scoring is unavailable (N/A), precluding subscore-based quantification. The EPSS score of 0.00300 (22.6th percentile of exploited CVEs) indicates a low modeled probability of near-term exploitation. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog. No threat actor campaigns or exploit-in-the-wild evidence have been reported.

Detection Guidance

The detection content below targets the vulnerability class (CWE-502 deserialization gadget execution in Python-based tooling) rather than a CVE-specific signature, because no exploit payload has been disclosed. Analysts should treat these as hunting rules and tune them to local baselines.

Sigma Rule

title: Python Parent Process Spawning System Shell - Potential Deserialization Gadget Execution
id: 6f90b2bd-1c2c-4e2a-9d5e-4f3d7acd1a11
status: experimental
description: >
  Detects a Python process (e.g., an ML workload using PyTorch extensions) spawning
  a system shell. This behavior is a common post-deserialization outcome for CWE-502
  gadget chains that invoke os.system or subprocess.Popen-like callables.
  Correlate with CVE-2026-35502 threat context (Intel Extension for PyTorch < 2.8.0,
  local user, interactive session).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-35502
author: Valters IT Threat Intelligence
date: 2025-06-03
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\python.exe'
      - '\python3.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\sh.exe'
      - '\bash.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate Python tooling that invokes shell commands (package managers, build scripts, ML data pipelines).
  - Analysts or developers running shell commands from an interactive Python REPL.
level: medium
tags:
  - attack.privilege-escalation
  - attack.t1068
  - cwe.502

YARA Rule

rule CVE_2026_35502_Pickle_Deserialization_Gadget_Hunt
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Hunts for Python pickle byte streams that contain common command-execution gadget patterns (os.system, subprocess.Popen, builtins.exec). Class-level detection for CWE-502 targeting ML artifacts loaded by Intel Extension for PyTorch."
        cve = "CVE-2026-35502"
        date = "2025-06-03"
        severity = "medium"
    strings:
        $pickle_p2 = { 80 02 }              // pickle protocol 2
        $pickle_p3 = { 80 03 }              // pickle protocol 3
        $pickle_p4 = { 80 04 }              // pickle protocol 4
        $pickle_p5 = { 80 05 }              // pickle protocol 5
        $gadget_os_system = "cos" "system"
        $gadget_subprocess = "csubprocess" "Popen"
        $gadget_builtins_exec = "cbuiltins" "exec"
        $gadget_posix_system = "cposix" "system"
    condition:
        filesize < 10MB and
        any of ($pickle_p*) and
        any of ($gadget_*)
}

Note: YARA matches on the raw byte stream; ML model files or checkpoints that embed serialized payloads may trigger. Triaging should confirm whether the pickle stream originates from trusted tooling or an untrusted artifact.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-35502 Potential Python Pickle Deserialization Gadget Payload Over HTTP"; flow:established,to_server; content:"|80 04|"; http_client_body; content:"cos"; http_client_body; content:"system"; http_client_body; classtype:attempted-user; reference:cve,2026-35502; sid:202635502; rev:1;)

Usage note: Since CVE-2026-35502 is a local-access vulnerability, network signatures provide limited coverage. This rule detects exfiltration or delivery of malicious serialized artifacts (e.g., poisoned model checkpoints fetched over HTTP into an ML environment) and should be paired with host-based rules.

Elastic Detection

// EQL query: Run in the Elastic Security "Hunting" timeline or rule engine.
// Detects a Python process spawning a shell within a short window.
sequence by host.id, user.id with maxspan=1m
  [ process where event.type == "start" and
      process.name in ("python.exe", "python3", "python") ]
  [ process where event.type == "start" and
      process.name in ("cmd.exe", "powershell.exe", "pwsh", "sh", "bash") ]

Tuning: Add exclusions for known-good package managers, notebook kernels (Jupyter), and CI orchestration tools. Raise the alert level if the parent Python process's command line references model/checkpoint loading (e.g., file paths ending in .pt or .pth) — however, such extensions are not confirmed in the NVD data and should be validated against local workloads.

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security EventCode=4688
  [ search index=windows sourcetype=WinEventLog:Security EventCode=4688
      NewProcessName="*python*.exe"
      | rename Process_GUID as parent_guid ]
| where ParentProcessName LIKE "%python%" 
    AND NewProcessName IN ("*\\cmd.exe", "*\\powershell.exe", "*\\pwsh.exe", "*\\bash.exe")
| eval suspicious = if(match(CommandLine, "(?i)system|exec|popen|subprocess"), "high", "medium")
| table _time, host, user, ParentProcessName, NewProcessName, CommandLine, suspicious
| sort - _time

Alternative Linux hunting query:

index=linux sourcetype=linux_audit
| where process_name IN ("bash", "sh", "dash")
    AND process_start AND parent_process_name IN ("python3", "python")
| table _time, host, user, parent_process_name, process_name, cmdline

Wazuh OSSEC Rule

<group name="sysmon,python_deserialization,">
  <!-- CVE-2026-35502 class-level detection: python spawning shell (Windows/Sysmon) -->
  <rule id="100355" level="10" frequency="1" timeframe="60">
    <field name="win.system.eventID">1</field>
    <field name="win.eventdata.parentImage">\python.exe</field>
    <field name="win.eventdata.image">\cmd.exe</field>
    <description>CVE-2026-35502 (class): Python process spawned a system shell - potential deserialization gadget execution via Intel Extension for PyTorch.</description>
    <group>attack.privilege_escalation,</group>
    <mitre>
      <id>1068</id>
    </mitre>
  </rule>

  <rule id="100356" level="10" frequency="1" timeframe="60">
    <field name="win.system.eventID">1</field>
    <field name="win.eventdata.parentImage">\python.exe</field>
    <field name="win.eventdata.image">\powershell.exe</field>
    <description>CVE-2026-35502 (class): Python process spawned PowerShell - potential deserialization gadget execution.</description>
    <group>attack.privilege_escalation,</group>
    <mitre>
      <id>1068</id>
    </mitre>
  </rule>
</group>

Operational note for SOC teams: All detection rules above are heuristic, class-level indicators. Given the absence of a public PoC, they are intended to increase visibility into deserialization-attempt side effects (process spawning, shell activity from Python) rather than to match a specific exploit byte sequence. Validate against normal ML workload behavior before enabling in-blocking mode.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No tracked source (vendor advisory, mailing list, distribution tracker) confirms an official patch, vendor fix, or workaround as of this report. The NVD description's "before version 2.8.0" language indicates the fixed release is 2.8.0, but teams must not assume the upgraded package is already published and verified.

1. Immediate mitigations (while unpatched):

• Restrict local access to systems running Intel Extension for PyTorch < 2.8.0; enforce least-privilege local accounts and remove interactive logon rights for unprivileged users where operationally feasible.
• Educate users on the requirement for active user interaction in the attack chain: do not open or load model artifacts, checkpoints, or data bundles from untrusted sources, including email attachments, shared drives, and third-party repositories.
• Run ML workloads that consume external artifacts inside isolated sandboxes, containers with read-only root filesystems, or dedicated non-privileged service accounts.
• Monitor user-mode process behavior on affected hosts using the Detection Guidance rules above, with particular attention to Python processes spawning shells.

2. Patch/upgrade steps:

• Continuously monitor Intel's official advisory channels and the Intel Extension for PyTorch distribution page for the 2.8.0 release.
• When 2.8.0 (or later) is published, upgrade all affected deployments. Validate in a staging environment first, given the library's tight coupling to specific PyTorch and Intel hardware versions.
• If the package is pinned by version-locked requirements files or container images, update those manifests and rebuild images; do not rely on in-place pip install --upgrade for production GPU/XPU nodes without regression testing.

3. Long-term hardening:

• Adopt serialization formats and deserialization paths that do not permit dynamic code execution during object reconstruction where feasible for the ML pipeline; maintain strict provenance controls for model artifacts (signed or hash-verified checkpoints).
• Implement application-level input validation and allow-listing for artifact types processed by the extension.
• Treat local privilege-escalation findings as systemic risks: apply routine OS patching, enable Windows Defender Credential Guard / Linux user-namespace restrictions, and segment ML development environments from production data stores.
• Reassess this report's EPSS-driven risk posture (0.00300) periodically; if exploitation activity appears in the wild or the CVE is added to CISA KEV, elevate priority accordingly.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-35502
2. CWE-502: Deserialization of Untrusted Data — https://cwe.mitre.org/data/definitions/502.html
3. Intel Extension for PyTorch (project distribution) — https://github.com/intel/intel-extension-for-pytorch
4. MITRE ATT&CK Technique T1068 — Exploitation for Privilege Escalation — https://attack.mitre.org/techniques/T1068/
5. CISA Known Exploited Vulnerabilities Catalog (not listed for this CVE) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / in-the-wild evidence: None documented. No exploit code, Nuclei template, or PoC is publicly available. This report reflects the vulnerability-class risk; the true exploitation mechanics may differ once vendor analysis or a PoC is published.

Report generated for v altersit.com threat intelligence consumers. Accuracy note: specific implementation details (functions, file paths, serialization entry points) are not present in the NVD description and are deliberately not fabricated; all technical characterization is at the CWE-502 class level.