Meta fairseq rerank code injection enables remote code execution (ZDI-26-942)
Original title: ZDI-26-942: (0Day) Meta fairseq rerank Code Injection Remote Code Execution Vulnerability
ZDI rates the unpatched fairseq flaw CVSS 7.8; a victim must open a malicious file or page.
ZDI published ZDI-26-942 as a zero-day in Meta fairseq. The rerank code-injection bug lets a remote attacker run arbitrary code if the user visits a malicious page or opens a malicious file. ZDI assigned CVSS 7.8. The advisory snippet gives no affected versions, fix, or CVE.
Unconfirmed: The zero-day label does not confirm real-world attacks or whether Meta has a patch.
- ZDI labels ZDI-26-942 a zero-day in Meta fairseq.
- Exploitation needs the user to visit a page or open a file.
- ZDI assigned a CVSS score of 7.8.
- No fixed version or CVE appears in the advisory snippet.
Impact: Remote arbitrary code execution after user interaction
| Product | Affected |
|---|---|
| Meta fairseq | — |
- Vendors
- Meta
- Products
- fairseq
- Organizations
- Zero Day Initiative
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta fairseq. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.