Ultralytics FastSAM EUVD-2026-102551

Exploitation requires the victim to load an attacker-supplied model file through the Ultralytics AutoBackend model-loading routine, where the model metadata fields imgsz, names, or kpt_shape are passed into a dynamic eval and thus interpreted as code. The vector is local (AV:L) - there is no network-facing exposure - and the attack is bounded by the need to deliver a crafted model and have it loaded by a user/process. The input vector assigns PR:L, but in the practical threat model the attacker supplies the malicious artifact rather than holding privileges on the victim host; authentication requirements beyond local model loading are not clearly established. There is no automatic/default-configuration trigger: the limiting factor is that someone must choose to load an untrusted model.

The provided CVSS 4.0 base score is 4.8 (medium) with vector AV:L/AC:L/AT:N/PR:L/UI:N and low impact across confidentiality, integrity and availability (VC:L/VI:L/VA:L). The local attack vector plus a privilege requirement (PR:L) materially constrains real-world risk - this is not a remotely reachable, drive-by flaw. There is no KEV listing, no POC referenced in the input, and no EPSS score was supplied, so exploitation probability cannot be quantified from the data; exploit maturity is explicitly undefined (E:X). Weighing these signals together, this reads as a low-to-moderate priority issue rather than an urgent one: real but gated behind local access and the need for a victim to load an attacker-controlled model. One notable tension: the CWE is CWE-95 (eval injection / improper neutralization of directives in dynamically evaluated code), which typically yields arbitrary code execution with HIGH impact, yet the input vector rates all impacts as LOW - this discrepancy should be verified with the vendor, as a genuine eval-based RCE would warrant a higher impact rating than the supplied score reflects.

An attacker crafts a malicious model file whose metadata fields (imgsz, names, or kpt_shape) embed code directives. When a user loads that model locally through the Ultralytics AutoBackend model-loading path, the tainted metadata is passed into a dynamic evaluation (eval), executing attacker-controlled code in the context of the loading process. No public exploit is identified at time of analysis, and the local attack vector with low complexity means a user who can be induced to open an untrusted model is the realistic victim.