THU-MIG YOLOE CVE-2026-111865

Exploitation requires a victim to load an attacker-crafted model through the AutoBackend model-loading path, where the model's imgsz, names, or kpt_shape metadata fields are passed to a Python eval() call in ultralytics/nn/autobackend.py and executed. The prerequisite is possession/opening of an untrusted model file on the local system (CVSS AV:L, PR:L). Limiting factors: it is not remotely exploitable without first delivering a malicious model, there is no network-facing trigger, the attacker cannot act without the victim loading the crafted artifact, and the affected software is an obscure research project with limited deployment - all of which substantially reduce realistic risk despite the code-execution nature of the flaw.

Multiple signals converge on LOW real-world priority. The VulDB-assigned CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:N) and resulting 1.9 base score reflect a local-only flaw requiring some privilege, and no EPSS score was provided in the input. The vulnerability is NOT on the CISA KEV list, so there is no evidence of active exploitation; the only exploitation signal is a publicly available exploit code exists (a GitHub issue report, #148). However, there is a meaningful conflict between the labeled impact and the vulnerability class: CWE-95 (eval injection) in a model-loading path typically yields arbitrary code execution, yet VulDB rated confidentiality, integrity and availability all as Low (VC:L/VI:L/VA:L) and privileges as PR:L - an unusually conservative scoring that likely reflects the 'you must already be local and load an untrusted model' framing rather than the true technical ceiling, which is code execution. Net assessment: this is a genuine code-injection bug but a low-urgency one, because it is not network-reachable, requires the victim to load an attacker-supplied model file, and affects a niche academic research project rather than widely deployed software. It is not a high-CVSS-but-low-risk inversion; it is a low-CVSS, low-prevalence issue whose impact label arguably understates the eval-based code-execution potential - verify the true impact against the source before deprioritizing in ML-pipeline threat models.

An attacker publishes or shares a crafted YOLOE/Ultralytics model file whose embedded metadata fields (imgsz, names, or kpt_shape) contain malicious Python expressions. When a victim loads that model locally through the AutoBackend loader, the eval() call in autobackend.py evaluates the attacker-controlled string and runs arbitrary code in the victim's process. A public exploit reference exists via the project's GitHub issue tracker, and because exploitation is local with low complexity, a successful trigger requires only that the victim open the untrusted model.