Vulnerability Report

CVE-2026-12191

Title: Deserialization in Comma AI Openpilot

Input Validation Error

Proof Of Concept

PoC Available for CVE-2026-12191

CWE Category CWE-20

Published Date Jun 14, 2026

Modified Date Jul 24, 2026

Exploit Status Available

Score 7.1 CVSS v4.0

Exploit Probability (EPSS)

0.14%

Vulnerability Summary

CVE-2026-12191: A vulnerability was found in Comma AI Openpilot 0.11. This issue affects the function pickle.load/pickle.loads of the file selfdrive/modeld/modeld.py of the component Pickle Module. The manipulation results in deserialization. The attack is only possible with local access. The vendor was contacted early about this disclosure but did not respond in any way.

Impacted Vendors

Analysis in Progress...

Reference Links

https://vuldb.com/cve/CVE-2026-12191 https://vuldb.com/submit/825699 https://vuldb.com/vuln/370837 https://vuldb.com/vuln/370837/cti

CVSS v4.0

Source Entity [email protected]

Severity HIGH

7.1

Attack Vector

LOCAL

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

N/A

RAW VECTOR

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

Source Entity [email protected]

Severity HIGH

7.8

Attack Vector

LOCAL

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

6.8

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:L/AC:L/Au:S/C:C/I:C/A:C

Associated Attack Patterns (CAPEC)

Total: Patterns