ZDI discloses 0-day RCE in Meta FAIRChem MLIPPredictUnit
Original title: ZDI-26-948: (0Day) Meta FAIRChem MLIPPredictUnit Deserialization of Untrusted Data Remote Code Execution Vulnerability
Deserialization in MLIPPredictUnit can run code if a user opens a malicious page or file; CVSS 7.8.
ZDI published ZDI-26-948, labeled a 0-day, affecting Meta FAIRChem's MLIPPredictUnit component. It is a deserialization-of-untrusted-data flaw that allows remote code execution. Exploitation requires the target to visit a malicious page or open a malicious file. ZDI assigned a CVSS rating of 7.8. No fixed version or CVE appears in the snippet.
Unconfirmed: The snippet does not state a patch, CVE, or whether attacks have occurred.
- The component named is MLIPPredictUnit.
- The advisory identifier is ZDI-26-948 and it is marked (0Day).
- User interaction is required.
- ZDI rates the issue 7.8.
Impact: Remote code execution after a user opens malicious content
| Product | Affected |
|---|---|
| Meta FAIRChem | — |
- Vendors
- Meta
- Products
- FAIRChem
- Organizations
- Zero Day Initiative
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.