FAIRChem dense_eval dft-targets deserialization flaw allows RCE
Original title: ZDI-26-809: Meta FAIRChem dense_eval dft-targets Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI-26-809 scores the dft-targets flaw 7.8; exploitation needs a malicious page or file.
ZDI published ZDI-26-809, covering unsafe deserialization in Meta FAIRChem’s dense_eval dft-targets path. An attacker can execute arbitrary code remotely if the target opens a malicious file or visits a malicious page. ZDI rated it CVSS 7.8. The snippet does not state versions, remediation, or exploitation.
Unconfirmed: Affected versions, a fix, and any exploitation are not stated.
- The issue is tracked as ZDI-26-809.
- ZDI assigned a CVSS rating of 7.8.
- User interaction is required to exploit the flaw.
- The affected path is dense_eval dft-targets.
Impact: Remote arbitrary code execution after user interaction
| Product | Affected |
|---|---|
| Meta FAIRChem dense_eval dft-targets | — |
- ATT&CK
- T1204 User Execution
- Vendors
- Meta
- Products
- FAIRChem
- Organizations
- Zero Day Initiative
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.