Zero Day Initiative Discloses Ultralytics torch_load RCE Vulnerability
A critical deserialization vulnerability in the Ultralytics Python library allows remote attackers to execute arbitrary code.
The Zero Day Initiative (ZDI) has publicly disclosed a critical remote code execution (RCE) vulnerability, tracked as ZDI-26-812, affecting the popular Ultralytics Python library. This flaw resides within the torch_load function and stems from an insufficient validation of user-supplied data, leading to the deserialization of untrusted input. Successful exploitation allows an attacker to execute arbitrary code in the context of the currently logged-in user.
The vulnerability requires user interaction, meaning an attacker must trick a victim into opening a malicious file or visiting a compromised webpage that triggers the vulnerable function. Once exploited, the attacker gains the ability to run commands on the affected system, potentially leading to further compromise or data theft. The CVSS score for this vulnerability is rated at 7.8, indicating a high level of risk.
ZDI reported the vulnerability to the vendor via their GitHub account on June 18, 2026. After several follow-ups and a lack of vendor response, ZDI notified the vendor of their intention to publish an advisory as a zero-day on October 22, 2026. The coordinated public release of the advisory occurred on October 28, 2026, with an update to the advisory on the same day.
Given the nature of the vulnerability, which relies on deserialization of untrusted data triggered by user interaction, the primary mitigation strategy recommended is to restrict interaction with the product. This means users should be cautious about opening files from untrusted sources or visiting unknown websites that might leverage this flaw. No specific patches or updates from Ultralytics have been detailed in the advisory, emphasizing the need for user vigilance.
This vulnerability highlights the ongoing risks associated with deserialization flaws in widely used libraries, particularly in the machine learning and deep learning ecosystems where complex data structures are frequently processed. The delay in vendor response, leading to a zero-day disclosure, also underscores the challenges in timely vulnerability management and patching.
Users and organizations relying on the Ultralytics library are strongly advised to review the ZDI advisory and implement the recommended mitigation strategies. Further updates regarding vendor patches or specific affected versions are expected as the situation develops. The anonymous researcher credited for discovering this flaw adds to the growing trend of security researchers contributing to the open-source security landscape.
This new advisory, ZDI-26-813, details a distinct remote code execution vulnerability within the check_det_dataset function of Ultralytics. Unlike the previously reported torch_load flaw, this vulnerability stems from improper validation of user-supplied strings used in Python code execution, requiring user interaction through a malicious page or file.
The Zero Day Initiative (ZDI) has published details on ZDI-26-816, a critical remote code execution vulnerability affecting Ultralytics. This new advisory specifies the flaw lies within the load_dataset_cache_file function, stemming from deserialization of untrusted data, and requires user interaction for exploitation, carrying a CVSS score of 7.8.