Ultralytics CVE-2026-118617

Exploitation requires the victim to load an attacker-supplied dataset whose cache file is processed by Ultralytics' load_dataset_cache_file function, which deserializes the untrusted cache data without proper validation; the description explicitly requires user interaction - the target must visit a malicious page or open/load a malicious file. Limiting factors that reduce realistic risk: the attack vector is LOCAL (AV:L), not remote network-triggerable, and success depends entirely on social engineering the user into loading attacker-controlled cache/dataset content. Code executes only in the context of the current user (S:U), so impact is bounded by that user's privileges. No specific non-default configuration is named as a prerequisite beyond use of the vulnerable cache-loading code path.

This is a locally-exploitable, user-interaction-dependent remote code execution flaw via insecure deserialization (CWE-502) in Ultralytics' load_dataset_cache_file function. The CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) is internally consistent: it is NOT a network-facing, unauthenticated, click-free bug despite PR:N - the AV:L and UI:R metrics mean an attacker needs the victim to open or load a malicious file/page locally, which materially reduces real-world urgency compared to a true remote RCE. Signal comparison: the vuln.today decision label is 'this_week' (elevated but not act_now/emergency); the finding originates from ZDI (ZDI-26-816 / ZDI-CAN-30124), a credible research source, but there is NO CISA KEV listing, NO EPSS score, and NO verified public exploit code in the provided data. No conflicting signals are present, but several are simply absent (EPSS and KEV both missing). Bottom line: a genuine high-impact code-execution bug worth patching promptly, but the local vector plus mandatory user interaction make it targeted/social-engineering-dependent rather than a wormable mass-exploitation threat - prioritize this week, not as a same-day emergency.

An attacker crafts a malicious dataset cache file and distributes it (e.g., bundled with a shared dataset, model repo, or linked from a malicious page) to a developer or ML practitioner using Ultralytics. When the victim loads the dataset and load_dataset_cache_file deserializes the untrusted cache, embedded attacker-controlled objects execute arbitrary code in the context of the current user. No verified public exploit code is identified in the available data, though ZDI holds a non-public advisory (ZDI-26-816).