Meta FAIRChem OMolRunner deserialization flaw allows remote code execution
Original title: ZDI-26-800: Meta FAIRChem OMolRunner Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI-26-800 rates the OMolRunner issue 7.8 and requires a user to open malicious content.
ZDI published ZDI-26-800 for a deserialization-of-untrusted-data vulnerability in Meta FAIRChem’s OMolRunner component. Remote attackers can execute arbitrary code only after a user visits a malicious page or opens a malicious file. ZDI assigned CVSS 7.8. No versions, patch, or attack activity are given.
Unconfirmed: Affected versions, a fix, and any exploitation are not stated.
- The issue is tracked as ZDI-26-800.
- ZDI assigned a CVSS rating of 7.8.
- The user must visit a malicious page or open a malicious file.
- The named component is OMolRunner.
Impact: Remote arbitrary code execution after user interaction
| Product | Affected |
|---|---|
| Meta FAIRChem OMolRunner | — |
- ATT&CK
- T1204 User Execution
- Vendors
- Meta
- Products
- FAIRChem
- Organizations
- Zero Day Initiative
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.