Ultralytics EUVD-2026-112258

Exploitation requires the victim to load attacker-supplied data through the Ultralytics torch_load function - in practice opening a malicious PyTorch model/weights file or visiting a page that causes such a file to be deserialized. The vulnerable code performs no proper validation of the user-supplied serialized data before deserializing it. Limiting factors: the vector is Local (AV:L) with Required user interaction (UI:R), so there is no unauthenticated network-reachable trigger; code runs only in the context of the current user (S:U, no scope change or privilege escalation). Authentication is not required (PR:N), but the mandatory user action of opening/loading a malicious artifact is the primary constraint on real-world exploitation.

This is a genuine but not emergency-tier priority. The CVSS 3.0 base score of 7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects full compromise of confidentiality, integrity and availability, but the Local attack vector (AV:L) plus Required user interaction (UI:R) are the key risk-dampening signals: an attacker cannot reach this over the network unaided - the victim must open a malicious model file or visit a malicious page that causes the vulnerable torch_load call to deserialize attacker-controlled data. Note the tension between the AV:L metric and the description's phrasing of 'remote attackers': this is the standard ZDI file/content-delivery framing where delivery may be remote but the trigger is local file/page handling, so AV:L is correct and no network-exposed service is directly attackable. No EPSS score is provided, so exploitation probability cannot be quantified; the vulnerability is NOT in CISA KEV and there is no confirmed public exploit code - only the ZDI advisory. The vuln.today decision label is 'this_week' (moderate urgency), consistent with a high-impact RCE that nonetheless depends on user interaction rather than mass remote exploitation. Bottom line: a real, high-impact RCE worth patching this week, but not evidence of active, widespread, or automatable exploitation at the time of analysis.

An attacker crafts a malicious PyTorch model/weights file (or hosts a page that causes one to be loaded) and socially engineers a developer or ML practitioner into opening it with Ultralytics, which calls torch_load on the untrusted data. Deserialization of the crafted payload executes arbitrary code in the context of the current user. No confirmed public exploit code was identified at time of analysis; only the ZDI advisory exists.