Meta FAIRChem Solvent path allows RCE via untrusted deserialization
Original title: ZDI-26-799: Meta FAIRChem Solvent Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI scores ZDI-26-799 at 7.8 and says the victim must open a malicious page or file.
ZDI published ZDI-26-799, a deserialization-of-untrusted-data flaw in Meta FAIRChem's Solvent component. Remote attackers can execute arbitrary code if the target visits a malicious page or opens a malicious file. ZDI assigned CVSS 7.8. No CVE, versions, or patch are given.
Unconfirmed: No CVE, affected versions, fix, or confirmed exploitation is stated.
- The advisory id is ZDI-26-799.
- The affected function area is named Solvent.
- User interaction is required to exploit it.
- ZDI's CVSS score is 7.8.
Impact: Remote arbitrary code execution after user interaction
| Product | Affected |
|---|---|
| Meta FAIRChem | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.