ZDI Discloses Five Unpatched Genesis World Zero-Days

ZDI disclosed five unpatched Genesis World flaws on Oct. 13, including two RCE issues rated CVSS 7.8, with no CVEs assigned.

The Zero Day Initiative published five unpatched Genesis World 0-day advisories on 2026-10-13. ZDI-26-752 is a directory-traversal remote code execution flaw in decompress_usdz, and ZDI-26-756 is a deserialization-of-untrusted-data remote code execution flaw in load_checkpoint; both are rated CVSS 7.8. ZDI-26-755 is a server-side request forgery issue in glTF handling rated CVSS 6.1. ZDI-26-753 and ZDI-26-754 are directory-traversal information-disclosure flaws in MJCF and URDF handling, respectively, each rated CVSS 5.5. All five say exploitation requires interaction with the library, and several say the attack vector depends on implementation; none cite a CVE, affected version, mitigation, or confirmed exploitation. The reports do not disagree.

• On 2026-10-13, ZDI published five unpatched Genesis World 0-day advisories; none cite a CVE, affected version, mitigation, or confirmed exploitation.
• ZDI-26-756 is an unpatched load_checkpoint deserialization-of-untrusted-data remote code execution flaw rated CVSS 7.8.
• ZDI-26-752 is an unpatched decompress_usdz directory-traversal remote code execution flaw rated CVSS 7.8.
• ZDI-26-755 is an unpatched glTF server-side request forgery flaw rated CVSS 6.1.
• ZDI-26-753 (MJCF) and ZDI-26-754 (URDF) are unpatched directory-traversal information-disclosure flaws, each rated CVSS 5.5.
• All five require interaction with the library; several say the attack vector depends on implementation.