Meta FAIRChem migrate_checkpoint 0-day allows remote code execution
Original title: ZDI-26-950: (0Day) Meta FAIRChem migrate_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI rates the unpatched checkpoint-migration deserialization bug 7.8 and says user interaction is required.
ZDI published ZDI-26-950, an unpatched deserialization flaw in Meta FAIRChem migrate_checkpoint. Remote code execution is possible if a user opens a malicious file or visits a malicious page. The note does not list versions, a fix, or a CVE.
Unconfirmed: The advisory does not confirm attacks or name fixed or affected versions.
- The affected function is migrate_checkpoint.
- CVSS is 7.8 according to ZDI.
- The title marks the issue as a 0-day.
- No exploitation in the wild is described.
Impact: remote arbitrary code execution after user interaction
| Product | Affected |
|---|---|
| Meta FAIRChem | — |
- Vendors
- Meta
- Products
- FAIRChem
- Organizations
- Zero Day Initiative
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.