FAIRChem dense_eval results-file deserialization flaw allows RCE
Original title: ZDI-26-798: Meta FAIRChem dense_eval results-file Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI-26-798 rates the results-file flaw 7.8 and requires the user to open malicious content.
ZDI published ZDI-26-798 for a deserialization-of-untrusted-data bug in Meta FAIRChem’s dense_eval results-file handling. Remote code execution is possible only if a user visits a malicious page or opens a malicious file. ZDI assigned CVSS 7.8. Versions, a fix, and exploitation status are not included.
Unconfirmed: Affected versions, a fix, and any exploitation are not stated.
- The issue is tracked as ZDI-26-798.
- ZDI assigned a CVSS rating of 7.8.
- The user must open a malicious page or file.
- The named path is dense_eval results-file.
Impact: Remote arbitrary code execution after user interaction
| Product | Affected |
|---|---|
| Meta FAIRChem dense_eval results-file | — |
- ATT&CK
- T1204 User Execution
- Vendors
- Meta
- Products
- FAIRChem
- Organizations
- Zero Day Initiative
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.