Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityhigh

Meta FAIRChem ion_db_path flaw allows code execution

Original title: ZDI-26-794: Meta FAIRChem ion_db_path Deserialization of Untrusted Data Remote Code Execution Vulnerability

ZDI Published Advisories ()1
Read at zerodayinitiative.com
Part of a story covered by 17 sourcesZDI publishes 10 Meta FAIRChem untrusted-data RCE advisoriesMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

ZDI rates the ion_db_path deserialization bug 7.8 and says user interaction is required.

ZDI published ZDI-26-794, a deserialization-of-untrusted-data vulnerability in Meta FAIRChem’s ion_db_path handling. Remote code execution is possible if the user visits a malicious page or opens a malicious file. Affected versions, a fix, and a CVE are not stated.

Key facts
  • The advisory is ZDI-26-794.
  • The named component is ion_db_path.
  • ZDI assigns CVSS 7.8.
  • The target must open malicious content.
Security assessment · AI, from the article

Impact: arbitrary code execution after user interaction

ProductAffected
Meta FAIRChem—
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
ATT&CK
T1189 Drive-by CompromiseT1204.002 Malicious File
Tags
fairchemmetadeserializationremote-code-executionzdi
Vendors
Meta
Products
FAIRChem

From the original article

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.

ZDI Published Advisories

zerodayinitiative.com

Read the full article at ZDI Published Advisories

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.