CVE-2026-111991 WongKinYiu CVE debrief

Who should care

Defenders responsible for WongKinYiu yolov9 0.1 installations should assess exposure to remote exploitation and prioritize verification of the vulnerability status. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure that affected systems are identified and remediated or mitigated appropriately.

Why it matters

Defenders should prioritize verifying the vulnerability status of WongKinYiu yolov9 0.1 installations and assessing exposure to remote exploitation due to the publicly disclosed exploit and potential for code injection.

• Remote exploitation is possible
• Exploit has been disclosed publicly and may be used
• Verification of vulnerability status is required

Technical summary

The vulnerability affects the function DetectMultiBackend.__init__ of the file models/common.py of the component ONNX Metadata Handler in WongKinYiu yolov9 0.1. The manipulation of the argument names/stride leads to code injection. This could allow remote exploitation, which is possible as the exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet. Defenders should prioritize verifying the vulnerability status of WongKinYiu yolov9 0.1 installations and assessing exposure to remote exploitation.

Defensive priority

Defenders should prioritize verifying the vulnerability status of WongKinYiu yolov9 0.1 installations and assessing exposure to remote exploitation.

Recommended defensive actions

• Verify the vulnerability status of WongKinYiu yolov9 0.1 installations
• Assess exposure to remote exploitation
• Monitor for publicly disclosed exploits
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The exploit has been disclosed publicly, but there is no information on actual exploitation or impact. Defenders should verify the vulnerability status of WongKinYiu yolov9 0.1 installations and assess exposure to remote exploitation due to the publicly disclosed exploit and potential for code injection. Limited source detail is available, so explicit evidence limits and defensive verification tasks are required.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.