The vulnerability arises because the native inference process in Elasticsearch does not validate that an offset used to compute a memory address from a model operation remains within the allocated storage bounds. A maliciously crafted model can exploit this to perform out-of-bounds memory access, causing heap corruption. With sufficient control over heap layout, this can escalate to arbitrary code execution within the inference process context. The affected versions explicitly include Elasticsearch 8.19.0, 9.4.0, and 9.5.0. No patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation can lead to heap corruption causing denial of service by crashing the inference process. More critically, it may allow an attacker to execute arbitrary code within the context of the Elasticsearch inference process, potentially compromising the system. The attack requires privileges to upload and deploy machine learning models, limiting the threat to authorized users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the ability to upload and deploy machine learning models to trusted users only. Monitor vendor communications for updates on patches or official mitigations.