CVE-2026-35502: Intel PyTorch Privilege Escalation Flaw

CVE-2026-35502 Overview

CVE-2026-35502 is a deserialization of untrusted data vulnerability [CWE-502] affecting Intel(R) Extension for PyTorch before version 2.8.0. The flaw exists within Ring 3 user application space and allows an unprivileged local attacker to escalate privileges when a user interacts with a malicious serialized object. Exploitation requires local access and user interaction, which limits remote exploitability. Successful exploitation impacts the confidentiality, integrity, and availability of the affected system at a low level. Intel disclosed the issue in security advisory SA-01497 and released a fixed build in version 2.8.0.

Critical Impact
A local unauthenticated attacker can trigger privilege escalation by convincing a user to load a crafted serialized object through Intel Extension for PyTorch versions before 2.8.0.

Affected Products

Intel(R) Extension for PyTorch versions prior to 2.8.0
Python environments and machine-learning workloads that import the affected extension
Systems using Intel CPU/GPU acceleration for PyTorch that depend on the vulnerable package

Discovery Timeline

2026-08-11 - CVE-2026-35502 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database
2026-08-13 - EPSS score published at 0.3% (percentile 22.459)

Technical Details for CVE-2026-35502

Vulnerability Analysis

The vulnerability originates from unsafe deserialization of attacker-controlled data within Intel Extension for PyTorch. PyTorch and its extensions commonly use Python's pickle module for saving and loading model artifacts, optimizer states, and tensor collections. When a program deserializes untrusted objects, embedded callable references can execute during reconstruction. An attacker who supplies a crafted serialized artifact can therefore run arbitrary code in the process context of the user loading the file. The advisory characterizes the outcome as escalation of privilege within Ring 3 user applications rather than a kernel-level compromise.

Root Cause

The root cause is insecure deserialization [CWE-502] of untrusted input. The affected code path reconstructs Python objects without validating the source or restricting permitted classes during deserialization. Because pickle-style serialization treats input as executable object graphs, any attacker who influences the byte stream can hijack the reconstruction process. Intel resolved the flaw in Intel Extension for PyTorch 2.8.0.

Attack Vector

Exploitation requires local access and active user interaction. A typical scenario involves a user downloading a shared model checkpoint, pretrained weights file, or notebook artifact from an untrusted source and loading it through the affected extension. When the deserialization routine processes the crafted object, embedded logic executes with the privileges of the invoking user. The attacker does not need prior authentication or special internal knowledge of the target, but they must persuade the user to open the malicious artifact.

No public proof-of-concept exploit is currently listed for this CVE. Refer to the Intel Security Advisory SA-01497 for vendor-supplied technical details.

Detection Methods for CVE-2026-35502

Indicators of Compromise

Unexpected child processes spawned by Python interpreters running PyTorch workloads, particularly shells or network utilities launched from data-science environments.
Loading of .pt, .pth, .pkl, or similar model artifact files sourced from untrusted repositories or email attachments.
Outbound network connections initiated immediately after torch.load or intel_extension_for_pytorch import operations.

Detection Strategies

Inventory Python environments and identify installed versions of intel_extension_for_pytorch below 2.8.0 using pip list or software bill of materials tooling.
Enable audit logging for process creation events on hosts used for ML development and correlate Python parent processes with unexpected child binaries.
Scan model artifacts prior to loading using tools such as picklescan or fickling to detect embedded opcodes that reference dangerous callables.

Monitoring Recommendations

Alert on file writes to autostart locations, cron entries, or user shell profiles originating from Python processes on developer workstations and training servers.
Monitor for network egress from ML training hosts to non-approved destinations, especially shortly after model deserialization events.
Track installation and upgrade events for the affected package across managed endpoints to confirm remediation coverage.

How to Mitigate CVE-2026-35502

Immediate Actions Required

Upgrade Intel Extension for PyTorch to version 2.8.0 or later across all developer workstations, build servers, and training clusters.
Prohibit loading of PyTorch model artifacts from untrusted third-party repositories or unverified collaborators until packages are patched.
Communicate the risk to data-science teams and require model artifacts to originate from internal, signed sources.

Patch Information

Intel released a fixed build in Intel Extension for PyTorch 2.8.0. Full remediation details are available in the Intel Security Advisory SA-01497. Apply the upgrade through your organization's Python dependency management workflow and rebuild container images that pin earlier versions.

Workarounds

Restrict deserialization to trusted files only and validate cryptographic signatures or hashes of model artifacts before loading.
Where feasible, use safer serialization formats such as safetensors for model weights instead of pickle-based .pt files.
Isolate model-loading operations in sandboxed containers or virtual machines with minimal privileges and no network access to reduce blast radius.

bash

# Upgrade Intel Extension for PyTorch to the patched version
pip install --upgrade "intel-extension-for-pytorch>=2.8.0"

# Verify the installed version
python -c "import intel_extension_for_pytorch as ipex; print(ipex.__version__)"