CVE-2026-18285
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
Vulnerability in the Aeon library in the load_rehab_pile_dataset method allows remote code execution via deserialization of untrusted data. Lack of user data validation leads to deserialization of untrusted objects. User interaction is required.
Risk Assessment
An attacker can execute arbitrary code in the context of the current process, potentially leading to system compromise or data theft.
Recommendation
Update the Aeon library to the latest version and avoid processing untrusted input.
Other vulnerabilities in Aeon
See all- CVE-2026-18287High
Vulnerability in the aeon library in the load_time_series_segmentation_benchmark method allows remote code execution via Python code injection. Lack of string validation before using it to execute code. User interaction is required.
- CVE-2026-18286High
Vulnerability in the aeon library in the load_human_activity_segmentation_datasets method allows remote code execution via Python code injection. Lack of string validation before using it to execute code. User interaction is required.
Original NVD description (English source)
Aeon load_rehab_pile_dataset Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the load_rehab_pile_dataset method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28749.