Ultralytics EUVD-2026-112261

Exploitation requires the victim to load or open an attacker-supplied input that reaches the parse_model function with a malicious user-supplied string (per the description, visiting a malicious page or opening a malicious file) - typically a crafted model definition/configuration processed by Ultralytics. Limiting factors: the CVSS vector is local (AV:L) and requires user interaction (UI:R), so there is no remote network-triggered path and no automated mass exploitation without a user action; code executes only in the context of the current user (S:U), so impact is bounded by that user's privileges rather than escalating system-wide. No authentication is required to the application itself (PR:N), but the human-interaction gate is the primary constraint on realistic exploitation.

This is a code-injection RCE (CWE-94) in Ultralytics' parse_model function, scored 7.8 (High) on CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vector is the key signal: despite being 'RCE,' this is NOT remote-unauthenticated network exploitation - AV:L plus UI:R means the attacker cannot reach the flaw over the network and the victim must actively open a malicious file or model configuration locally. No CISA KEV listing and no EPSS score are present in the input, so there is no quantitative exploitation-probability signal and no confirmation of active exploitation. The only reference is the ZDI advisory (ZDI-26-815, ex ZDI-CAN-30123); there is no PoC or exploit reference in the input, so exploitation status is: no public exploit identified at time of analysis. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a high-impact-but-interaction-gated flaw rather than a mass-exploitation emergency. Net: genuine full-impact code execution (C:H/I:H/A:H) in the current user's context, but real-world risk is moderated by the required user interaction and local vector - prioritize patching, but it is not a drop-everything network-facing crisis. Missing data: no EPSS, no KEV, no vendor-confirmed fixed version in the provided input.

An attacker crafts a malicious Ultralytics model/configuration file (or a page serving one) that embeds a user-controlled string reaching parse_model. When a victim data scientist or engineer loads/opens that model in their environment, the unvalidated string is executed as Python code, running arbitrary commands in the context of the current user. Exploitation requires that user interaction (AV:L/UI:R); no public exploit code is identified in the provided data.