Microsoft Qlib MLflowRecorder Deserialization Vulnerability Allows Remote Code Execution
Original title: ZDI-26-850: Microsoft Qlib MLflowRecorder Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI-26-850 reports a remote code execution vulnerability in Microsoft Qlib that requires user interaction to exploit.
This vulnerability in Microsoft Qlib allows remote attackers to execute arbitrary code on affected installations. The target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
- User interaction required to trigger exploitation
- CVSS rating of 7.8
- Remote code execution via deserialization of untrusted data
Impact: remote code execution
| Product | Affected |
|---|---|
| Microsoft Qlib | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.