Meta fairseq HubertModel YAML parsing allows remote code execution
Original title: ZDI-26-923: (0Day) Meta fairseq HubertModel YAML File Parsing Code Injection Remote Code Execution Vulnerability
The unpatched flaw needs a user to open a malicious file and carries a ZDI CVSS score of 7.8.
ZDI published ZDI-26-923 as a zero-day in Meta fairseq. Malicious YAML parsed by HubertModel can lead to remote arbitrary code execution when a user opens the file. The CVSS rating is 7.8. No product versions, fixed release, or CVE appear in the notice.
Unconfirmed: The notice does not confirm exploitation, affected versions, a patch, or a CVE.
- HubertModel YAML file parsing is the affected path.
- User interaction is required to open the file.
- ZDI assigned CVSS 7.8 and labeled it a zero-day.
Impact: Arbitrary code execution after opening a malicious file
| Product | Affected |
|---|---|
| Meta fairseq | — |
- 1.Avoid opening untrusted YAML files handled by HubertModel.
- ATT&CK
- T1204.002 Malicious File
- Vendors
- Meta
- Products
- fairseq
- Organizations
- Zero Day Initiative
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta fairseq. User interaction is required to exploit this vulnerability in that the target must open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.