Remote Code Execution Vulnerability in Ultralytics Product
CVE-2026-118617

7.8HIGH

Key Information:

Vendor

Ultralytics

Status
Ultralytics
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118617?

A vulnerability in the Ultralytics Model allows remote attackers to exploit the load_dataset_cache_file function, leading to the potential execution of arbitrary code. This security issue arises from insufficient validation of user-supplied input, which may result in untrusted data being deserialized. Although user interaction is required for exploitation, such as visiting a malicious webpage or opening an infected file, the implications of this flaw could allow an attacker to execute code in the context of the user, compromising system integrity.

Affected Version(s)

Ultralytics 8.4.65

References

https://www.zerodayinitiative.com/advisories/ZDI-26-816/
x_research-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.