Remote Code Execution in Ultralytics Product Due to Deserialization Flaw
CVE-2026-118613

7.8HIGH

Key Information:

Vendor

Ultralytics

Status
Ultralytics
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118613?

A vulnerability exists in the Ultralytics torch_load function, allowing remote attackers to execute arbitrary code on affected installations. This flaw is primarily due to the inadequate validation of user-supplied data, leading to the deserialization of untrusted data. To exploit the vulnerability, user interaction is necessary, as the target must either visit a malicious website or open a compromised file. Attackers can leverage this flaw to execute code in the context of the current user, potentially compromising the system and its data.

Affected Version(s)

Ultralytics 8.4.65

References

https://www.zerodayinitiative.com/advisories/ZDI-26-812/
x_research-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.