ms-swift CVE-2026-10801

Exploitation requires local system access with at least low-privileged credentials (CVSS PR:L) - remote unauthenticated exploitation is not possible. High attack complexity (AC:H) is required: the attacker must specifically construct or stage PIL images whose raw pixel byte buffers (as returned by image.tobytes()) are identical despite differing in dimensions or color mode, which requires deliberate image crafting, not incidental input. The vulnerable code path is triggered when Template._save_pil_image is invoked during multimodal template processing in ms-swift; this requires the PIL image caching feature to be active in the deployment. Exploitation is limited to versions up to 4.2.0 of ms-swift. There is no user interaction required (UI:N) once the attacker can supply or stage crafted images. The limiting factors - local-only access, high complexity, and the need to control image content entering the cache - significantly constrain realistic exploitation to insider-threat or post-compromise scenarios in ML pipeline environments.

The overall risk is very low. The CVSS 4.0 base score of 1.1 reflects an attack vector of Local (AV:L), high attack complexity (AC:H), and low privileges required (PR:L), with confidentiality impact of None (VC:N) and only limited integrity (VI:L) and availability (VA:L) impacts in the vulnerable system. There is no scope change to downstream systems (SC:N, SI:N, SA:N). The exploit maturity modifier E:P confirms a publicly available proof-of-concept, but this does not elevate the practical risk substantially given the local-only attack surface and high complexity requirement. No EPSS data was provided in the intelligence sources, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation. The attack requires an adversary who already has local, authenticated access to the host and must craft or stage image files specifically designed to collide - this is not a scenario that lends itself to opportunistic, automated exploitation. The primary real-world impact is incorrect image retrieval from cache, which could silently corrupt multimodal LLM inference inputs, a subtle but potentially meaningful data integrity concern in fine-tuning or inference pipelines.

A local, low-privileged user on a system running ms-swift fine-tuning or inference pipelines crafts two PIL images with identical raw pixel byte buffers but different dimensions - for example, 120×80 and 80×120 - so that image.tobytes() produces the same byte sequence for both. When the first image is processed and cached via Template._save_pil_image, the second image resolves to the same cache key and is served the first image's cached file instead of its own, silently corrupting the multimodal model input. A proof-of-concept demonstrating this collision is publicly available at https://github.com/modelscope/ms-swift/issues/9360.