ZDI-26-756: (0Day) Genesis World load_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI disclosed an unpatched Genesis World load_checkpoint deserialization RCE rated CVSS 7.8.
ZDI published ZDI-26-756, an unpatched remote code execution flaw in Genesis World’s load_checkpoint function caused by deserialization of untrusted data. Remote attackers can execute arbitrary code on affected installations if the library is used, with vectors varying by implementation. ZDI assigned CVSS 7.8. No CVE or confirmed exploitation is stated.
- Unpatched ZDI-26-756 is in Genesis World load_checkpoint.
- Deserialization of untrusted data can yield remote code execution.
- Library interaction is required; ZDI rates it CVSS 7.8.
- The advisory cites no CVE or observed exploitation.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Genesis World. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.8.
This source does not provide full text. Read it at zerodayinitiative.com.