Is CVE-2026-111237 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111237 being exploited in the wild.

How severe is CVE-2026-111237?

Medium severity, with a CVSS score of 5.3, published 16 October 2026.

Which products and versions are affected?

Ultralytics FastSAM up to commit b4ed20c2fed75eadc5aa7d8b09fedd137b873b52 (vendored ultralytics 8.0.120).

How is CVE-2026-111237 attacked?

It is attacked with local access.

Am I affected by CVE-2026-111237?

Check whether you run Ultralytics FastSAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111237: Ultralytics FastSAM code execution in AutoBackend model loading

CVE-2026-111237 · Severity: medium · CVSS 5.3 · Published 2026-10-16

FastSAM is a computer vision tool for image segmentation tasks. An attacker can craft a malicious ONNX model file that executes arbitrary Python code when the model is loaded, before any image processing occurs. This allows complete compromise of systems that use FastSAM to load untrusted model files.

Vendors: Ultralytics.

Quick answers

Is CVE-2026-111237 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111237 being exploited in the wild.
How severe is CVE-2026-111237?: Medium severity, with a CVSS score of 5.3, published 16 October 2026.
Which products and versions are affected?: Ultralytics FastSAM up to commit b4ed20c2fed75eadc5aa7d8b09fedd137b873b52 (vendored ultralytics 8.0.120).
Is there a fix for CVE-2026-111237?: Yes: fixed in Sync to ultralytics >= 8.3.234, or apply one-line patch: replace eval(v) with ast.literal_eval(v) in ultralytics/nn/autobackend.py:278. Until then: Do not load ONNX model files from untrusted sources; restrict model loading to signed or curated model files only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111237 attacked?: It is attacked with local access.
Am I affected by CVE-2026-111237?: Check whether you run Ultralytics FastSAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Sync to ultralytics >= 8.3.234, or apply one-line patch: replace eval(v) with ast.literal_eval(v) in ultralytics/nn/autobackend.py:278

Do not load ONNX model files from untrusted sources; restrict model loading to signed or curated model files only.

Technical details

The vulnerability is code injection through eval() of untrusted metadata strings in ONNX model files. The AutoBackend model loader reads custom_metadata_map fields (imgsz, names, kpt_shape) from the .onnx file's protobuf and passes them directly to eval() without validation at ultralytics/nn/autobackend.py:278. An attacker can modify these metadata strings in any .onnx file to inject arbitrary Python code executed during model instantiation, requiring only local file access. The upstream ultralytics project fixed this in v8.3.234 by replacing eval() with ast.literal_eval().

Affected products

Ultralytics FastSAM up to commit b4ed20c2fed75eadc5aa7d8b09fedd137b873b52 (vendored ultralytics 8.0.120)

Timeline

2026-09-29: disclosed: Security issue reported on GitHub
2026-10-16: advisory: CVE-2026-111237 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.