CVE-2026-118617 in Ultralytics
Summary
by MITRE • 10/28/2026
Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the load_dataset_cache_file function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30124.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The Ultralytics library is a widely adopted open-source solution for computer vision tasks, including object detection and image segmentation. A critical security flaw has been identified within its data handling mechanisms, specifically in the load_dataset_cache_file function. This vulnerability represents a classic instance of insecure deserialization, where an application accepts untrusted input and processes it as executable code without adequate validation or sanitization. The Common Weakness Enumeration (CWE) categorizes this type of defect under CWE-502, which denotes Deserialization of Untrusted Data. Such flaws are particularly dangerous because they bypass standard access controls by allowing attackers to inject malicious objects that trigger arbitrary method calls during the deserialization process.
The technical root cause lies in the function's reliance on Python’s pickle module or similar serialization libraries that inherently support object instantiation upon loading. When a user provides a path to a cache file, the application loads this data directly into memory without verifying its integrity or origin. If an attacker can influence the content of this cache file, they can craft a payload containing serialized malicious objects. Upon execution, these objects execute arbitrary commands within the context of the process running Ultralytics. This mechanism effectively transforms a simple data loading operation into a remote code execution vector, provided the attacker has control over the input source or can trick the user into opening a specially crafted file.
The operational impact of this vulnerability is severe, as it grants an adversary full control over the affected system within the privileges of the current user account. This level of access allows for data exfiltration, modification of critical files, installation of backdoors, and further lateral movement within a network if the compromised host serves as a pivot point. The requirement for user interaction significantly influences the attack complexity; unlike purely remote exploits that trigger automatically upon visiting a webpage, this vulnerability necessitates social engineering or physical access to trick the target into opening a malicious file or loading untrusted data through the application interface. This aligns with MITRE ATT&CK technique T1203, which covers Exploitation for Client Execution, highlighting the reliance on user action to initiate the exploit chain.
Mitigation strategies must focus on eliminating the use of insecure deserialization methods whenever possible. Developers should replace pickle-based loading mechanisms with safer alternatives such as JSON or YAML, which do not support arbitrary code execution during parsing. If legacy compatibility requires continued use of serialization formats that allow object instantiation, strict input validation and whitelisting of allowed classes are essential to prevent the creation of malicious objects. Additionally, implementing sandboxing techniques can limit the potential damage if an exploit is successful by restricting file system access and network connectivity for processes handling untrusted data. Organizations relying on Ultralytics should apply available patches immediately or implement workarounds that validate all input sources before they reach the load_dataset_cache_file function to ensure no untrusted artifacts are processed as executable code.