Meta fairseq HubertModel YAML parsing allows remote code execution
The unpatched flaw needs a user to open a malicious file and carries a ZDI CVSS score of 7.8.
52
Product
fairseq
- Mentions · 7d31
- Mentions · 30d31
- All mentions31
- First seenNov 11, 2026
- Last mentioned14h ago
Timeline
31 articles · newest firstMeta fairseq FairseqLAMB YAML parsing allows remote code execution
Opening a crafted file is required; ZDI scores the unpatched issue 7.8 and names no patch.
52
Meta fairseq dump_km_label deserialization flaw allows RCE (ZDI-26-940)
Untrusted data deserialized by dump_km_label can run code; ZDI rates the zero-day 7.8.
48
Meta fairseq FairseqAdamax YAML parsing flaw enables RCE (ZDI-26-929)
The unpatched issue scores CVSS 7.8 and needs a user to open a crafted file.
58
Meta fairseq TransformerLanguageModel YAML bug allows code execution
ZDI-26-921 is an unpatched fairseq flaw rated 7.8 that needs a user to open a file.
52
Meta fairseq CtcCriterion YAML parsing allows code injection
ZDI-26-932 carries a 7.8 score and requires opening a malicious file; no CVE or fixed version is listed.
48
Meta fairseq S2TWavTransformerEncoder YAML parsing allows RCE
ZDI scores the zero-day 7.8 and says the victim must open a malicious file; no fix is listed.
52
Meta fairseq FairseqCPUAdam YAML parsing allows remote code execution
ZDI-26-936 is an unpatched code-injection flaw rated 7.8 that requires opening a malicious file.
52
Meta fairseq RawAudioDataset YAML parsing allows remote code execution
ZDI rates the unpatched flaw 7.8; a user must open a malicious file, and no fix is named.
52
Meta fairseq FilterNamesDataset flaw allows remote code execution
ZDI rates the unpatched FilterNamesDataset code-injection bug 7.8; a user must open a malicious page or file.
52
Meta fairseq YAML parsing flaw allows code execution (ZDI-26-919)
ZDI rates the FairseqAdafactor zero-day 7.8; the user must open a malicious file.
52
Meta fairseq Data2VecAudioModel YAML parsing bug allows code execution
ZDI-26-920 is an unpatched fairseq flaw rated 7.8 that requires opening a malicious file.
52
Meta fairseq split_by_lang flaw allows remote code execution
ZDI rates the unpatched split_by_lang code-injection bug 7.8; a user must open a malicious page or file.
52
fairseq load_speaker zero-day enables remote code execution
ZDI-26-917 scores the unpatched load_speaker code-injection flaw CVSS 7.8 and requires a malicious page or file.
52
Meta fairseq LightConvLanguageModel YAML parsing flaw enables RCE (ZDI-26-930)
ZDI rates the unpatched flaw 7.8; a user must open a malicious file before code runs.
58
Meta fairseq FConvLanguageModel YAML parsing allows code injection
ZDI-26-934 rates the unpatched flaw 7.8; the victim must open a malicious file, and no CVE or fixed version is given.
48
Meta fairseq Wav2Vec2Model YAML parsing bug allows remote code execution
ZDI rates the unpatched flaw 7.8; a user must open a malicious file before code runs.
52
Meta fairseq Wav2Vec YAML parsing can run code (ZDI-26-914)
ZDI rates the unpatched flaw 7.8; a user must open a malicious file for code execution.
58
Meta fairseq AudioModalityConfig YAML parsing allows code injection
ZDI-26-931 is scored 7.8 and requires a user to open a malicious file; no CVE or patch version is stated.
48
Meta fairseq rerank code injection enables remote code execution (ZDI-26-942)
ZDI rates the unpatched fairseq flaw CVSS 7.8; a victim must open a malicious file or page.
48
Meta fairseq load_checkpoint_to_cpu allows RCE (ZDI-26-943)
ZDI scores the unpatched deserialization bug 7.8 and says a malicious file or page is required.
58
Meta fairseq FConvModelSelfAtt YAML parsing allows remote code execution
ZDI-26-935 is an unpatched code-injection bug rated 7.8 that needs a user to open a file.
52
Meta fairseq MultiresHubertModel YAML parsing allows code injection
ZDI-26-933 is rated 7.8 and needs a user to open a malicious file; no CVE or patched release is stated.
48
Meta fairseq quantize_with_kmeans flaw allows remote code execution
ZDI-26-937 is an unpatched deserialization bug rated 7.8 that needs a malicious page or file.
52
Meta fairseq W2lConvGluEncoder YAML parsing flaw enables RCE (ZDI-26-928)
ZDI scores the unpatched bug 7.8; code runs only if a user opens a malicious file.
58
Meta fairseq load_ema_from_checkpoint allows RCE (ZDI-26-944)
A user must open a malicious file or page; ZDI rates the unpatched fairseq flaw CVSS 7.8.
58
Meta fairseq FairseqAdam YAML parsing flaw enables RCE (ZDI-26-927)
Opening a malicious file is required; ZDI rates the unpatched issue CVSS 7.8.
58
Meta fairseq load_audio_path flaw can run code (ZDI-26-913)
ZDI rates the unpatched issue 7.8; the user must visit a malicious page or open a file.
58
fairseq VGGTransformerModel YAML parsing zero-day allows code execution
ZDI-26-918 rates the unpatched Meta fairseq YAML code-injection bug CVSS 7.8 if a malicious file is opened.
52
Meta fairseq parse_manifest flaw allows remote code execution (ZDI-26-938)
ZDI rates the unpatched flaw 7.8; a user must open a malicious file or visit a malicious page.
52
Meta fairseq YAML parsing flaw allows code execution (ZDI-26-941)
Opening a malicious YAML file can trigger code injection in FConvModel; ZDI scores it 7.8.
48
Appears with
- Zero Day Initiativeorganization · 31
- Metavendor · 31
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.