Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

ZDI publishes 10 Meta FAIRChem untrusted-data RCE advisories

1 source · 17 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

ZDI disclosed 10 Meta FAIRChem deserialization flaws, each scored 7.8, with no CVE, patch, or exploitation status.

On October 26, 2026, the Zero Day Initiative published 10 advisories describing deserialization of untrusted data in Meta FAIRChem. Each can let a remote attacker execute arbitrary code only if a user visits a malicious page or opens a malicious file. ZDI rates every issue CVSS 7.8. The notices name distinct paths or components but give no affected versions, fixes, CVE identifiers, or exploitation status.

Key facts
  • Advisories: ZDI-26-793, 794, 795, 796, 797, 799, 803, 804, 805, and 808.
  • Named areas include load_and_preprocess_data, ion_db_path, reaction_db_path, and run_validation.
  • Also named: reaction adsorbate_db_path, dense_eval dft-compute, Solvent, AdsorbMLRunner, Bulk Class, Adsorbate.
  • Every advisory is scored CVSS 7.8 and requires user interaction.
  • No CVE, affected version, patch, or exploitation status is stated.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 26, 2026ZDI publishes 10 Meta FAIRChem deserialization advisories · ZDI Published Advisories

What each outlet adds

beyond the shared facts
  • ZDI Published AdvisoriesLists 10 distinct FAIRChem paths, all CVSS 7.8, none with a CVE or fix
Vendors
Meta
Products
FAIRChem
Organizations
Zero Day Initiative

Coverage

oldest first · one row per article · UTC
  1. · 4d ago ZDI Published AdvisoriesFirst report

    FAIRChem dense_eval dft-targets deserialization flaw allows RCE

    ZDI-26-809 scores the dft-targets flaw 7.8; exploitation needs a malicious page or file.

  2. · 4d ago ZDI Published Advisories

    Meta FAIRChem deserialization flaw allows remote code execution

    ZDI-26-807 needs a user to open a malicious file or page; the advisory rates it CVSS 7.8.

  3. · 4d ago ZDI Published Advisories

    FAIRChem dense_eval results-file deserialization flaw allows RCE

    ZDI-26-798 rates the results-file flaw 7.8 and requires the user to open malicious content.

  4. · 4d ago ZDI Published Advisories

    Meta FAIRChem run_validation deserialization bug allows remote code execution

    ZDI-26-808 is scored 7.8 and needs the target to open a malicious page or file.

  5. · 4d ago ZDI Published Advisories

    Meta FAIRChem reaction_db_path flaw allows code execution

    ZDI scores the reaction_db_path deserialization issue 7.8; opening untrusted content is required.

  6. · 4d ago ZDI Published Advisories

    Meta FAIRChem ion_db_path flaw allows code execution

    ZDI rates the ion_db_path deserialization bug 7.8 and says user interaction is required.

  7. · 4d ago ZDI Published Advisories

    Meta FAIRChem AdsorbMLRunner deserialization flaw allows remote code execution

    ZDI-26-803 is rated CVSS 7.8 and needs a user to open a file or visit a page.

  8. · 4d ago ZDI Published Advisories

    Meta FAIRChem Bulk Class deserialization flaw allows remote code execution

    ZDI-26-804 is rated CVSS 7.8 and requires opening a file or visiting a page.

  9. · 4d ago ZDI Published Advisories

    Meta FAIRChem dense_eval dft-compute flaw allows code execution

    ZDI rates the deserialization bug 7.8; a user must open a malicious page or file.

  10. · 4d ago ZDI Published Advisories

    Meta FAIRChem write_top_k_vasp bug allows remote code execution

    ZDI rates the deserialization flaw 7.8 and says the victim must open a malicious page or file.

  11. · 4d ago ZDI Published Advisories

    Meta FAIRChem process_mlrs deserialization flaw allows remote code execution

    ZDI-26-802 is rated CVSS 7.8 and requires opening a file or visiting a page.

  12. · 4d ago ZDI Published Advisories

    Meta FAIRChem Solvent path allows RCE via untrusted deserialization

    ZDI scores ZDI-26-799 at 7.8 and says the victim must open a malicious page or file.

  13. · 4d ago ZDI Published Advisories

    Meta FAIRChem Adsorbate deserialization flaw allows remote code execution

    ZDI-26-805 is rated CVSS 7.8 and needs a user to open a file or visit a page.

  14. · 4d ago ZDI Published Advisories

    Meta FAIRChem load_and_preprocess_data RCE via untrusted data deserialization

    ZDI rates the flaw 7.8; a user must open a malicious page or file, and no CVE or fix is named.

  15. · 4d ago ZDI Published Advisories

    Meta FAIRChem OMolRunner deserialization flaw allows remote code execution

    ZDI-26-800 rates the OMolRunner issue 7.8 and requires a user to open malicious content.

  16. · 4d ago ZDI Published Advisories

    Meta FAIRChem adsorbate_db_path flaw allows code execution

    ZDI rates the reaction adsorbate_db_path deserialization bug 7.8 and requires user interaction.

  17. · 4d ago ZDI Published Advisories

    Meta FAIRChem Slab deserialization flaw allows remote code execution

    ZDI-26-801 rates the FAIRChem Slab issue 7.8; a victim must open a malicious file or page.