Ultralytics: Remote code execution via deserialization in load_dataset_cache_file
Summary
The Ultralytics computer vision framework contains a deserialization of untrusted data flaw in the load_dataset_cache_file function. An attacker can supply a malicious dataset cache file that executes arbitrary code in the context of the user running the affected software. Exploitation requires the user to open a malicious file or visit a malicious page. The CVSS score of 7.8 is based on the ZDI and CNA data; the sources disagree on the attack vector.
Affected
- Ultralytics 8.4.65 (named in the sources)
- Full affected version range: Unknown.
Fixed in
- Unknown. No vendor advisory or fix referencing this CVE was found.
Workaround
- Restrict interaction with the product: load dataset and cache files only from trusted sources.
- Run training in an isolated VM or container.
Exploitation
- Published as a zero-day by ZDI on 28 October 2026; vendor notified 22 October 2026.
- No evidence of exploitation in the wild and not listed in CISA KEV.
- No public exploit found in Metasploit or Exploit-DB at the time of research.
- EPSS: 0.26 % (percentile 18).
Our recommendation
- Inventory all Ultralytics installations (for example with pip show ultralytics) and identify which hosts load untrusted dataset or cache files.
- Restrict loading of dataset and cache files to trusted sources until a vendor fix is available.
- Run training jobs in isolated environments and monitor for unexpected child processes.
- Install the vendor fix as soon as it is published and check NVD for analysis updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- ZDI-26-816 advisory www.zerodayinitiative.com
- VulDB CVE-2026-118617 vuldb.com
- Strix CVE-2026-118617 www.strix.ai
- OffSeq ZDI-26-816 radar radar.offseq.com
- EUVD-2026-112262 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:48.
Original description (NVD)
Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the load_dataset_cache_file function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30124.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.