This vulnerability in Comma AI Openpilot 0.11 arises from the use of Python's pickle module functions (pickle.load/pickle.loads) in the selfdrive/modeld/modeld.py component, which allows unsafe deserialization. An attacker with local access could manipulate serialized data to execute arbitrary code or cause other harmful effects. The vendor was notified but has not provided any response or remediation. The CVSS 4.0 score is 8.5, indicating high severity with local attack vector, low complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation requires local access and can result in arbitrary code execution or other malicious actions due to unsafe deserialization. This can compromise the confidentiality, integrity, and availability of the affected system running Openpilot 0.11. No known exploits in the wild have been reported as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should restrict local access to trusted parties and monitor for suspicious activity related to the affected component. Avoid loading untrusted pickle data until an official fix is released.