Meta fairseq dump_km_label deserialization flaw allows RCE (ZDI-26-940)
Original title: ZDI-26-940: (0Day) Meta fairseq dump_km_label Deserialization of Untrusted Data Remote Code Execution Vulnerability
Untrusted data deserialized by dump_km_label can run code; ZDI rates the zero-day 7.8.
ZDI published ZDI-26-940 as a zero-day in Meta fairseq. Deserialization of untrusted data in dump_km_label can let a remote attacker execute arbitrary code if the user visits a malicious page or opens a malicious file. ZDI assigned CVSS 7.8. No versions, patch, or CVE are given.
Unconfirmed: ZDI's zero-day marking does not confirm exploitation or a Meta patch.
- The flaw is unsafe deserialization in fairseq dump_km_label.
- User interaction is required via a page or file.
- ZDI assigned a CVSS rating of 7.8.
- The snippet does not name a fixed build.
Impact: Remote code execution via untrusted deserialization
| Product | Affected |
|---|---|
| Meta fairseq | — |
- Vendors
- Meta
- Products
- fairseq
- Organizations
- Zero Day Initiative
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta fairseq. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.