Ultralytics EUVD-2026-112260

The victim must load an attacker-supplied Ultralytics model via the vulnerable torch_safe_load function - e.g., opening a crafted model/weights file or visiting a page that triggers such a load; the flaw is OS command injection (CWE-78) where a user-supplied string is passed to a system call without validation. Exploitation is gated by mandatory user interaction (UI:R) and a local attack vector (AV:L): there is no network-reachable trigger, and code runs only with the privileges of the user who loads the file. The practical limiting factor is model provenance - environments that only load trusted, internally produced weights are not realistically exposed, while those ingesting third-party or community model files are.

The CVSS 3.0 base score is 7.8 (High), but the vector tells a more nuanced story: AV:L and UI:R mean this is NOT remote-wild exploitation - an attacker cannot reach the flaw over the network and must induce the victim to load an attacker-controlled model file. PR:N indicates no authentication is needed once the file is opened, and the C:H/I:H/A:H impact reflects full code execution in the current user's context. There is no CISA KEV listing and no EPSS score was supplied, so exploitation probability cannot be quantified from the input; the only exploitation signal is a single ZDI advisory (ZDI-26-814, from ZDI-CAN-30122), which is a coordinated-disclosure advisory rather than confirmed working exploit code. The vuln.today decision label is 'this_week' - an elevated-but-not-emergency priority consistent with a user-interaction-gated local RCE in a popular ML library. Net assessment: this is a genuine priority for anyone running untrusted or third-party Ultralytics model weights, but the mandatory user-interaction and local-vector constraints make it materially lower real-world risk than a network-reachable unauthenticated RCE of the same score; absent EPSS/KEV data, treat it as a supply-chain/model-provenance hygiene issue rather than a mass-exploitation threat.

An attacker publishes or shares a malicious Ultralytics model file (or lures the victim to a page that triggers a model load), and when the victim loads it through the affected torch_safe_load path, an attacker-supplied string is passed into a system call without validation, executing arbitrary code as that user. Exploitation requires that victim interaction (opening the file/visiting the page), consistent with the CVSS AV:L/UI:R metrics. A ZDI advisory reference exists, but no working exploit code is confirmed in the available data.