CVE-2026-12191: Comma AI Openpilot Pickle modeld.py pickle.loads deserialization

Synopsis

An insecure deserialization vulnerability affects Comma AI Openpilot version 0.11, specifically in the pickle.load/pickle.loads function within selfdrive/modeld/modeld.py. The attack requires local access to the host and a low-privilege account; no network exposure is involved. Successful exploitation gives an attacker full read, write, and crash capability over the affected process, which in a vehicular context means potential tampering with driving model data. No fix version has been published; HarborGuard tracks this advisory and will surface a patched rebuild the moment upstream ships one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to reach the vulnerable code path.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker operates independently once local access is established.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors are required.

Blast Radius

• Reads confidential data accessible to the modeld process, including model inputs and outputs that may contain sensor or environmental data.
• Modifies persisted or in-memory model state, enabling an attacker to tamper with driving decisions produced by the Openpilot model pipeline.
• Crashes the modeld process, disrupting the self-driving assistance system and potentially triggering a failsafe or unsafe vehicle state.
• Full code execution within the modeld process context means the attacker can chain further actions against other local services or files the process can reach.