Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

ZDI publishes six unpatched Meta Detectron2 deserialization zero-days

1 source · 6 articlesFirst reported Updated ()
What's new

November 11: ZDI also published Detectron2 zero-days in vertex_feature_embedder, LazyConfig, and CfgNode.merge_from_file, all CVSS 7.8 and unpatched.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

ZDI disclosed six unpatched Meta Detectron2 deserialization flaws, each scored CVSS 7.8, with no fixes or CVEs.

On November 11, 2026, the Zero Day Initiative published six zero-day advisories for untrusted-data deserialization in Meta Detectron2. The issues affect detection_checkpoint, vertex_feature_embedder, LazyConfig, load_proposals_into_dataset, DensePose, and CfgNode.merge_from_file. ZDI says a remote attacker can run arbitrary code if a user visits a malicious page or opens a malicious file. Each advisory is scored CVSS 7.8. No CVE IDs, affected versions, or patches are named.

Key facts
  • Advisory IDs are ZDI-26-907 through ZDI-26-912, all marked zero-day.
  • Each flaw is untrusted-data deserialization scored CVSS 7.8.
  • Exploitation requires a malicious page visit or opening a malicious file.
  • Named areas include LazyConfig, DensePose, and CfgNode.merge_from_file.
  • No CVE, affected version, or fixed release is stated.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 11, 2026ZDI publishes six Detectron2 deserialization zero-days · ZDI Published Advisories

What each outlet adds

beyond the shared facts
  • ZDI Published AdvisoriesNames six Detectron2 components, IDs ZDI-26-907 to ZDI-26-912, all CVSS 7.8.
  • Trend Micro Zero Day InitiativeIdentifies ZDI as Trend Micro’s program for the DensePose advisory.
Vendors
Meta
Products
Detectron2
Organizations
Zero Day Initiative

Coverage

oldest first · one row per article · UTC
  1. · 14h ago ZDI Published AdvisoriesFirst report

    Detectron2 vertex_feature_embedder zero-day enables remote code execution

    ZDI-26-907 rates the unpatched Meta Detectron2 flaw CVSS 7.8 and requires a malicious page or file.

  2. · 14h ago ZDI Published Advisories

    Detectron2 LazyConfig zero-day enables remote code execution

    ZDI-26-910 scores the unpatched LazyConfig deserialization bug CVSS 7.8 and requires user interaction.

  3. · 14h ago ZDI Published Advisories

    Meta Detectron2 checkpoint loading can run code (ZDI-26-912)

    Untrusted deserialization in detection_checkpoint is unpatched; ZDI rates it CVSS 7.8.

  4. · 14h ago ZDI Published Advisories

    Detectron2 load_proposals_into_dataset flaw allows RCE (ZDI-26-908)

    ZDI rates this Meta Detectron2 zero-day 7.8; opening a file or page is required.

  5. · 14h ago ZDI Published Advisories

    Meta Detectron2 DensePose flaw allows RCE via untrusted data (ZDI-26-911)

    ZDI rates the zero-day 7.8; a user must open a malicious file or visit a malicious page.

  6. · 14h ago ZDI Published Advisories

    Detectron2 CfgNode.merge_from_file flaw allows RCE (ZDI-26-909)

    ZDI scores the Meta Detectron2 zero-day 7.8 and says user interaction is required.