Ultralytics CVE-2026-118618

Exploitation requires the victim to load attacker-controlled input through Ultralytics' parse_model function - concretely, opening a malicious model file/configuration or visiting a page that triggers such a load (UI:R). The flaw is the lack of validation of a user-supplied string before it is used to execute Python code (CWE-94). Limiting factors that reduce real-world risk: the attack is local (AV:L), it cannot succeed without that user interaction, and code executes only with the privileges of the current user running the Ultralytics process (S:U, no privilege escalation). There is no network-facing, zero-click path in the described flaw; an environment that never loads untrusted model files/configs is not exposed.

This is a genuine but conditional risk rather than a drop-everything emergency. The provided CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description: the attack is local (AV:L) and requires user interaction (UI:R, the victim must open a malicious file or visit a malicious page), but needs no prior privileges (PR:N) and yields full confidentiality, integrity, and availability impact once triggered. Note the apparent tension between 'remote attackers' in the description and AV:L in the vector - this is reconciled by the UI:R requirement: the attacker is remote in the sense of delivering content, but code execution hinges on the victim locally loading attacker-supplied data, so the vector is correctly Local. No EPSS score was supplied, the CVE is not listed in CISA KEV, and the sole reference is the ZDI advisory (ZDI-26-817 / ZDI-CAN-30121), which is an advisory, not verified working exploit code. The vuln.today priority is 'this_week' and the finding originates from ZDI, indicating a credible, vendor-coordinated disclosure worth prompt patching, but there is currently no signal of active exploitation or public weaponized code. Net: a legitimately high-severity code-execution flaw, prioritize within the normal patch cycle (this week), not an active-exploitation fire drill.

An attacker crafts a malicious Ultralytics model configuration or file containing an attacker-controlled string that parse_model will use to execute Python. The victim, operating a workflow built on Ultralytics, opens the malicious file or visits a page that causes the file to be loaded, at which point the unvalidated string is executed as Python code with the victim's privileges. No public, verified exploit code is identified at time of analysis; only the ZDI advisory reference exists.