uproot EUVD-2026-45374

Exploitation requires the victim to open or process an attacker-crafted ROOT file with a vulnerable uproot version, and requires that uproot reach the affected class-code generation path - i.e., the file must contain custom class TStreamerInfo records whose file-controlled metadata (streamer element name, count name, or field name) is interpolated into the generated Python reader source. Per the CVSS 4.0 vector this is a LOCAL vector (AV:L) requiring passive user interaction (UI:P) but NO authentication (PR:N) and low complexity (AC:L). Limiting factors: the attacker cannot trigger this over the network without getting a malicious file into the victim's processing path, exploitation is scoped to processes that actually deserialize the malicious streamer records, and environments that only ever read self-generated or trusted ROOT files are not realistically reachable.

This is a genuine, high-severity remote-ish code execution but with a meaningful gating factor: the provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, VC:H/VI:H/VA:H, base 8.5) shows a LOCAL attack vector requiring passive user interaction - the victim must open or process the malicious ROOT file. There is no authentication requirement (PR:N), attack complexity is low, and impact is full compromise of confidentiality, integrity, and availability with no scope change (SC/SI/SA:N). No EPSS score, KEV listing, or POC was provided, so exploitation probability cannot be quantified; treat 'no public exploit identified at time of analysis' as the status, distinct from active exploitation. The realistic risk is high for any automated pipeline, grid job, or analysis workflow that ingests untrusted ROOT files, and lower for closed environments handling only self-produced files. Note the AV:L classification means this is not wormable network RCE despite the 'attacker-controlled file' framing - verify delivery path against your own workflow.

An attacker crafts a ROOT file whose TStreamerInfo streamer-element name contains Python expression-breaking content and delivers it to a victim - for example by uploading it to a shared analysis dataset, a physics data portal, or an automated processing queue. When a researcher or batch job opens the file with a vulnerable uproot version, uproot generates and invokes the reader method, evaluating the injected expression and running the attacker's Python in the victim's process. No public POC was provided, but the low attack complexity and file-driven trigger make exploitation straightforward for anyone who can place a file in the victim's read path.