ZDI publishes nine unpatched Meta FAIRChem deserialization RCE flaws

ZDI disclosed nine unpatched Meta FAIRChem zero-days that can run code if a user opens malicious content.

On November 11, 2026, Trend Micro's Zero Day Initiative published nine advisories for Meta FAIRChem, each labeled a zero-day. The flaws are deserialization of untrusted data in checkpoint, model-loading, NPZ, YAML, and prediction paths, and ZDI says a remote attacker can execute arbitrary code. Exploitation requires a user to open a malicious file or visit a malicious page. ZDI assigned CVSS 7.8 to each. The notices name no affected versions, patches, CVE identifiers, or in-the-wild exploitation.