Ultralytics torch_load untrusted deserialization leads to remote code execution
Original title: ZDI-26-812: (0Day) Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI-26-812 scores 7.8 and needs a user to open a malicious file or visit a malicious page.
ZDI-26-812 covers a zero-day deserialization-of-untrusted-data flaw in Ultralytics torch_load. Remote attackers can execute arbitrary code on affected installations after a user opens a malicious file or visits a malicious page. ZDI assigned CVSS 7.8. Affected and fixed versions are not stated.
Unconfirmed: The text does not confirm a patch, versions, or in-the-wild use.
- The advisory is ZDI-26-812 and labeled a zero-day.
- The issue is in torch_load via untrusted data deserialization.
- Successful attack yields remote code execution.
- ZDI's CVSS rating is 7.8 and user interaction is required.
Impact: remote arbitrary code execution after user interaction
| Product | Affected |
|---|---|
| Ultralytics | — |
- Vendors
- Ultralytics
- Organizations
- Zero Day Initiative
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.