Meta fairseq FairseqAdamax YAML parsing flaw enables RCE (ZDI-26-929)
Original title: ZDI-26-929: (0Day) Meta fairseq FairseqAdamax YAML File Parsing Code Injection Remote Code Execution Vulnerability
The unpatched issue scores CVSS 7.8 and needs a user to open a crafted file.
ZDI published ZDI-26-929, an unpatched YAML file-parsing code-injection flaw in Meta fairseq's FairseqAdamax component. Opening a malicious file lets a remote attacker execute arbitrary code. ZDI rates it CVSS 7.8. Versions, a patch, and a CVE are not stated.
Unconfirmed: In-the-wild exploitation and patch availability are not stated.
- The advisory is ZDI-26-929 and marked 0-day.
- The user must open a malicious file.
- Assigned CVSS rating is 7.8.
- No affected or fixed versions are listed.
Impact: arbitrary code execution after opening a malicious file
| Product | Affected |
|---|---|
| Meta fairseq FairseqAdamax | — |
- 1.Avoid opening untrusted fairseq YAML files until patched.
- ATT&CK
- T1204.002 Malicious File
- Vendors
- Meta
- Products
- fairseq
- Organizations
- Zero Day Initiative
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta fairseq. User interaction is required to exploit this vulnerability in that the target must open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.