ZDI-26-812: (0Day) Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability
Summary: ZDI published a 0-day advisory for a remote code execution flaw in Ultralytics, where the torch_load function fails to properly validate user-supplied data and deserializes untrusted input, letting an attacker run code in the context of the current user. Exploitation requires user interaction - the target must visit a malicious page or open a malicious file - and ZDI reported the issue to the vendor's GitHub account on 06/18/26, asked for updates twice, then notified the vendor of its intent to publish as a 0-day on 10/22/26.
What you should know: The vendor was given roughly four months from the initial report and never responded, and ZDI's only stated mitigation is to restrict interaction with the product - meaning no patch exists to deploy.
Read the original at Zero Day Initiative ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-118613
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026