Medical-SAM-Adapter CVE-2026-111212

Exploitation requires the attacker to get a crafted model file loaded through the AutoBackend model-loading path (models/MobileSAMv2/ultralytics/nn/autobackend.py), where the imgsz, names, or kpt_shape metadata fields are passed into a dynamically evaluated (eval) expression without neutralization. Concrete prerequisites: local access to the host (AV:L), existing low-level privileges on the system (PR:L), and victim/user interaction to actually load the malicious model (UI:P). Limiting factors: there is no remote vector, no unauthenticated path, and impact is partial (Low C/I/A) and confined to the loading user's context (SC:N/SI:N/SA:N), so a user who only loads trusted, self-generated models is not exposed.

This is a low-priority issue despite being a code-injection flaw (CWE-95). All signals agree on low real-world risk. The CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:P/VC:L/VI:L/VA:L) yields a base score of only 2.4, reflecting that exploitation requires local access, existing low privileges, and victim interaction, while delivering only partial (Low) confidentiality, integrity, and availability impact rather than full system compromise. A public POC exists (E:P, referenced via the GitHub issue), which modestly raises practical concern, but there is NO CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of widespread or automated exploitation. The flaw resides in Medical-SAM-Adapter, a niche academic/research project, further limiting exposure. One caveat to verify: the affected code path lives in a bundled copy of ultralytics (models/MobileSAMv2/ultralytics/nn/autobackend.py), so the root cause is the well-known ultralytics AutoBackend metadata eval() pattern rather than code original to this project - defenders should check whether the upstream ultralytics fix applies. Net: a genuine but very low-severity local flaw, not an urgent remote threat.

An attacker who can place or convince a user to load a crafted model file supplies malicious imgsz/names/kpt_shape metadata that is passed to a dynamic eval() during AutoBackend model loading, causing attacker-controlled code to run in the context of the loading user. A public proof-of-concept exists (linked from the project's GitHub issue tracker). Because the attack is local and requires the victim to load the model (UI:P), it is most plausible in supply-chain or shared-model scenarios rather than remote attack.