CVE-2026-118613 in Ultralytics
Summary
by MITRE • 10/28/2026
Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the torch_load function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-29652.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The Ultralytics library, a widely adopted open-source solution for computer vision tasks including object detection and image segmentation, contains a critical security flaw within its model loading mechanism. Specifically, the vulnerability resides in the torch_load function, which is responsible for retrieving serialized PyTorch models from disk or network sources. This component relies on Python’s pickle module to deserialize these objects back into executable code structures. The core technical deficiency is an absence of rigorous validation and sanitization protocols for user-supplied data passed to this deserialization routine. Because the pickle format allows arbitrary object instantiation during the unpickling process, any untrusted input that reaches this function can be crafted by an attacker to trigger side effects beyond simple data reconstruction, effectively bypassing standard security boundaries within the application environment.
This flaw constitutes a classic instance of Deserialization of Untrusted Data, categorized under CWE-502 in industry standards for software weaknesses. The vulnerability enables Remote Code Execution with significant operational impact because it allows attackers to inject malicious payloads that are executed in the context of the user running the Ultralytics script or application. While the initial description notes that user interaction is required—such as visiting a malicious webpage hosting a crafted model file or opening a specially constructed dataset—the resulting compromise can be severe. Once exploited, an attacker gains full control over the underlying system processes, potentially leading to data exfiltration, lateral movement within a network, or complete system takeover depending on the privileges of the executing user.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1059, Command and Scripting Interpreter, specifically through Python execution capabilities inherent in deserialization attacks. The attack vector typically involves an adversary crafting a malicious pickle file that contains a class definition overriding standard object initialization methods to execute shell commands or download additional malware upon instantiation. This method is particularly dangerous because it often evades traditional signature-based detection systems since the payload is embedded within legitimate-looking data structures until runtime execution occurs.
Mitigation strategies must focus on eliminating the use of unsafe deserialization mechanisms where possible. Developers should avoid using pickle for loading untrusted models and instead adopt safer serialization formats such as JSON or ONNX, which do not support arbitrary code execution during parsing. If legacy model compatibility is required, strict allow-listing techniques can be implemented to restrict instantiation to only known safe classes. Additionally, running applications with the principle of least privilege ensures that even if exploitation occurs, the blast radius is contained by limiting file system and network access rights for the process executing the Ultralytics library.